vulnerability

Critical ownCloud flaw under attack (CVE-2023-49103)

November 28, 2023

Attackers are trying to exploit a critical information disclosure vulnerability (CVE-2023-49103) in ownCloud, a popular file sharing and collaboration platform used in …

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214)

November 27, 2023

A proof-of-concept (PoC) exploit for a high-severity flaw in Splunk Enterprise (CVE-2023-46214) that can lead to remote code execution has been made public. Users are advised …

How LockBit used Citrix Bleed to breach Boeing and other targets

November 22, 2023

CVE-2023-4966, aka “Citrix Bleed”, has been exploited by LockBit 3.0 affiliates to breach Boeing’s parts and distribution business, and “other trusted …

Microsoft announces Defender bug bounty program

November 22, 2023

Microsoft has announced a new bug bounty program aimed at unearthing vulnerabilities in Defender-related products and services, and is offering participants the possibility to …

Apache ActiveMQ bug exploited to deliver Kinsing malware

November 21, 2023

Attackers are exploiting a recently fixed vulnerability (CVE-2023-46604) in Apache ActiveMQ to install Kinsing malware and cryptocurrency miners on targeted Linux systems. …

Organizations’ serious commitment to software risk management pays off

November 21, 2023

There has been a significant decrease in vulnerabilities found in target applications – from 97% in 2020 to 83% in 2022 – an encouraging sign that code reviews, automated …

Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671)

November 20, 2023

CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, among them a critical vulnerability (CVE-2023-1671) in Sophos Web Appliance that has been …

Danish energy sector hit by a wave of coordinated cyberattacks

November 14, 2023

The Danish energy sector has suffered what is believed to be the most extensive cyberattack in Danish history, according to SektorCERT. Danish energy sector under attack …

Juniper networking devices under attack

November 14, 2023

CISA has ordered US federal agencies to patch five vulnerabilities used by attackers to compromise Juniper networking devices, and to do so by Friday. Most of these bugs are …

Looney Tunables bug exploited for cryptojacking

November 7, 2023

Kinsing threat actors have been spotted exploiting the recently disclosed Looney Tunables (CVE-2023-4911) vulnerability to covertly install cryptomining software into …

Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)

November 2, 2023

Ransomware-wielding attackers are trying to break into servers running outdated versions of Apache ActiveMQ by exploiting a recently fixed vulnerability (CVE-2023-46604). …

F5 BIG-IP vulnerabilities leveraged by attackers: What to do?