vulnerability

Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)

December 5, 2023

Russian state-backed hacking group Forest Blizzard (aka Fancy Bear, aka APT28) has been using a known Microsoft Outlook vulnerability (CVE-2023-23397) to target public and …

Qlik Sense flaws exploited in Cactus ransomware campaign

December 1, 2023

Attackers are exploiting three critical vulnerabilities in internet-facing Qlik Sense instances to deliver Cactus ransomware to target organizations, Arctic Wolf researchers …

Critical Zyxel NAS vulnerabilities patched, update quickly!

December 1, 2023

Zyxel has patched six vulnerabilities affecting its network attached storage (NAS) devices, including several (OS) command injection flaws that can be easily exploited by …

PoCs for critical Arcserve UDP vulnerabilities released

November 29, 2023

Arcserve has fixed critical security vulnerabilities (CVE-2023-41998, CVE-2023-41999, CVE-2023-42000) in its Unified Data Protection (UDP) solution, PoCs for which have been …

Google fixes Chrome zero day exploited in the wild (CVE-2023-6345)

November 29, 2023

Google has released an urgent security update to fix a number of vulnerabilities in Chrome browser, including a zero-day vulnerability (CVE-2023-6345) that is being actively …

Design flaw leaves Google Workspace vulnerable for takeover

November 28, 2023

A design flaw in Google Workspace’s domain-wide delegation feature, discovered by Hunters’ Team Axon, can allow attackers to misuse existing delegations, enabling privilege …

Critical ownCloud flaw under attack (CVE-2023-49103)

November 28, 2023

Attackers are trying to exploit a critical information disclosure vulnerability (CVE-2023-49103) in ownCloud, a popular file sharing and collaboration platform used in …

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214)

November 27, 2023

A proof-of-concept (PoC) exploit for a high-severity flaw in Splunk Enterprise (CVE-2023-46214) that can lead to remote code execution has been made public. Users are advised …

How LockBit used Citrix Bleed to breach Boeing and other targets

November 22, 2023

CVE-2023-4966, aka “Citrix Bleed”, has been exploited by LockBit 3.0 affiliates to breach Boeing’s parts and distribution business, and “other trusted …

Microsoft announces Defender bug bounty program

November 22, 2023

Microsoft has announced a new bug bounty program aimed at unearthing vulnerabilities in Defender-related products and services, and is offering participants the possibility to …

Apache ActiveMQ bug exploited to deliver Kinsing malware

November 21, 2023

Attackers are exploiting a recently fixed vulnerability (CVE-2023-46604) in Apache ActiveMQ to install Kinsing malware and cryptocurrency miners on targeted Linux systems. …

Organizations’ serious commitment to software risk management pays off