vulnerability

Researchers release PoC exploit for critical Windows CryptoAPI bug (CVE-2022-34689)

January 26, 2023

Akamai researchers have published a PoC exploit for a critical vulnerability (CVE-2022-34689) in Windows CryptoAPI, which validates public key certificates. “An attacker …

Critical VMware vRealize Log Insight flaws patched (CVE-2022-31706, CVE-2022-31704)

January 25, 2023

VMware has fixed two critical (CVE-2022-31706, CVE-2022-31704) and two important (CVE-2022-31710, CVE-2022-31711) security vulnerabilities in VMware vRealize Log Insight, its …

Extent of reported CVEs overwhelms critical infrastructure asset owners

January 23, 2023

The sheer volume of reported ICS vulnerabilities and CVEs may cause critical infrastructure asset owners to feel overwhelmed, or need help knowing where to begin, according to …

Trained developers get rid of more vulnerabilities than code scanning tools

January 23, 2023

An EMA survey of 129 software development professionals uncovered that for those using code scanning tools, only 10% of organizations prevented a higher percentage of …

Critical RCE vulnerabilities found in git (CVE-2022-41903, CVE-2022-23251)

January 19, 2023

A source code audit has revealed two critical vulnerabilities affecting git, the popular distributed version control system for collaborative software development. The latest …

Vulnerable NetComm routers and a public PoC exploit (CVE-2022-4873, CVE-2022-4874)

January 18, 2023

Two vulnerabilities (CVE-2022-4873, CVE-2022-4874) found in three NetComm router models could be exploited to achieve remote code execution on vulnerable devices, and …

PoC for critical ManageEngine bug to be released, so get patching! (CVE-2022-47966)

January 17, 2023

If your enterprise is running ManageEngine products that were affected by CVE-2022-47966, check now whether they’ve been updated to a non-vulnerable version because …

Cacti servers under attack by attackers exploiting CVE-2022-46169

January 16, 2023

If you’re running the Cacti network monitoring solution and you haven’t updated it since early December, now is the time to do it to foil attackers exploiting a …

Vulnerabilities in cryptographic libraries found through modern fuzzing

January 13, 2023

Recently patched vulnerabilities in MatrixSSL and wolfSSL, two open-source TLS/SSL implementations / libraries for embedded environments, have emphasized the great potential …

FortiOS flaw was exploited to compromise governmental targets (CVE-2022-42475)

January 13, 2023

A critical vulnerability in FortiOS SSL-VPN (CVE-2022-42475) that Fortinet has issued patches for in November 2022 has been exploited by attackers to compromise governmental …

Critical vulnerabilities in Siemens PLC devices could allow bypass of protected boot features (CVE-2022-38773)

January 12, 2023

Red Balloon Security disclosed multiple, critical architectural vulnerabilities in the Siemens SIMATIC and SIPLUS S7-1500 Series PLC that allow for bypass of all protected …

Cisco won’t fix router flaws even though PoC exploit is available (CVE-2023-20025, CVE-2023-20026)