Security Affairs

SEPTEMBER 8, 2022

The two issues have been tracked as CVE-2022-20696 (CVSS score: 7.5) and CVE-2022-28199 (CVSS score: 8.6) The CVE-2022-28199 flaw stems from a lack of proper error handling in DPDK’s network stack. Cisco also addressed a medium severity issue, tracked as CVE-2022-20863 (CVSS score: 4.3), in Cisco Webex Meetings App.

Authentication 143

Authentication Small Business Software Firewall 143

Security Affairs

OCTOBER 10, 2022

Fortinet has confirmed that the recently disclosed critical authentication bypass issue (CVE-2022-40684) is being exploited in the wild. Last week, Fortinet addressed a critical authentication bypass flaw, tracked as CVE-2022-40684 , that impacted FortiGate firewalls and FortiProxy web proxies. Pierluigi Paganini.

Authentication 129

Authentication Firewall Hacking Risk 129

Security Affairs

MAY 10, 2022

Microsoft Patch Tuesday security updates for May 2022 address three zero-day vulnerabilities, one of them actively exploited. Microsoft Patch Tuesday security updates for May 2022 addressed three zero-day vulnerabilities, one of which is under active attack. Follow me on Twitter: @securityaffairs and Facebook.

Authentication 138

Authentication Hacking Software Cybersecurity 138

Security Affairs

JANUARY 31, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds Apple improper authentication bug to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple improper authentication bug, tracked as CVE-2022-48618 , to its Known Exploited Vulnerabilities (KEV) catalog.

Authentication 134

Authentication Risk Cybersecurity Information Security 134

Security Affairs

OCTOBER 14, 2022

Experts released the PoC exploit code for the authentication bypass flaw CVE-2022-40684 in FortiGate firewalls and FortiProxy web proxies. A proof-of-concept (PoC) exploit code for the authentication bypass vulnerability CVE-2022-40684 (CVSS score: 9.6) SecurityAffairs – hacking, CVE-2022-40684). and from 7.2.0

Authentication 126

Authentication Firewall Hacking Risk 126

Security Affairs

AUGUST 10, 2022

VMware warns of the availability of a proof-of-concept exploit code for a critical authentication bypass flaw in multiple products. VMware warns its customers of the availability of a proof-of-concept exploit code for a critical authentication bypass flaw, tracked as CVE-2022-31656 , in multiple products. Pierluigi Paganini.

Authentication 110

Authentication Hacking Information Security 110

Security Affairs

FEBRUARY 18, 2022

Researchers developed an exploit code for CVE-2022-24086 vulnerability affecting Adobe?Commerce Positive Technologies researchers have created a working PoC exploit for the recently patched CVE-2022-24086 vulnerability affecting its Commerce and Magento Open Source products. The CVE-2022-24086 has received a CVSS score of 9.8

Authentication 120

Authentication Hacking Technology Cybersecurity 120

Krebs on Security

APRIL 27, 2023

Customers can access a Salesforce Community website in two ways: Authenticated access (requiring login), and guest user access (no login required). This misconfigured Salesforce Community site from the state of Vermont was leaking pandemic assistance loan application data, including names, SSNs, email address and bank account information.

Banking 343

Banking Government Information Security Authentication 343

Security Affairs

APRIL 25, 2023

Google announced that its Authenticator app for Android and iOS now supports Google Account synchronization. Google announced that its Google Authenticator app for both iOS and Android now supports Google Account synchronization that allows to safely backup users one-time codes to their Google Account.

Authentication 98

Authentication Accountability Backups Education 98

Security Affairs

JANUARY 17, 2022

The pre-release announcement for Critical Patch Update (CPU) for January 2022 states that Oracle will fix 483 new flaws. This pre-release announcement for Critical Patch Update (CPU) for January 2022 confirms that Oracle security updates will address 483 new security patches. The highest CVSS v3.1 Base Score (10.0)

Big data 125

Big data Financial Services Retail Insurance 125

Security Affairs

JANUARY 25, 2025

The duo found Subaru’s admin panel hosted on a subdomain, allowing password resets for employee accounts without confirmation, bypassing two-factor authentication. Researchers used the valid employee email to reset the password, bypass two-factor authentication, and gain access to the panels functionality. ” wrote Curry.

Hacking 126

Hacking Accountability Passwords Authentication 126

Security Affairs

OCTOBER 21, 2021

Threat actors are continually looking for better ways to target organizations, here are the top five attack vectors to look out for in 2022. Whether motivated by a potential payday or the ability to access confidential information, cybercriminals have plenty of incentive to focus on what works best in achieving their goals. Conclusion.

IoT 139

IoT Phishing Passwords Scams 139

Security Affairs

OCTOBER 15, 2022

Palo Alto Networks addressed a high-severity authentication bypass vulnerability affecting the PAN-OS 8.1 Palo Alto Networks released security patches to address a high-severity authentication bypass flaw, tracked as CVE-2022-0030 (CVSS score 8.1), impacting the PAN-OS 8.1 SecurityAffairs – hacking, CVE-2022-0030).

Firewall 145

Firewall Authentication Software Hacking 145

Security Affairs

DECEMBER 2, 2022

CyRC experts warn of weak or missing authentication mechanisms, missing authorization, and insecure communication vulnerabilities in the three apps. “An exploit of the authentication and authorization vulnerabilities could allow remote unauthenticated attackers to execute arbitrary commands. . Lazy Mouse versions 2.0.1

Hacking 145

Hacking Authentication Mobile Passwords 145

Security Affairs

NOVEMBER 23, 2022

Microsoft released an out-of-band update to fix problems tied to a recent Windows security patch that caused Kerberos authentication issues. Microsoft released an out-of-band update to address issues caused by a recent Windows security patch that causes Kerberos authentication problems. ” continues the advisory.

Authentication 102

Authentication Encryption Hacking Accountability 102

Security Affairs

AUGUST 3, 2023

CISA, the FBI, and NSA, along with Five Eyes cybersecurity agencies published a list of the 12 most exploited vulnerabilities of 2022. CISA, the NSA, and the FBI, in collaboration with cybersecurity authorities from Australia, Canada, New Zealand, and the United Kingdom, have published a list of the 12 most exploited vulnerabilities of 2022.

Authentication 98

Authentication VPN Hacking Internet 98

Security Affairs

SEPTEMBER 11, 2024

“Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.” could allow a remote authenticated attacker with admin privileges to execute arbitrary code on the core server. High) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Software 131

Software Authentication IoT Hacking 131

Security Affairs

FEBRUARY 3, 2023

Atlassian has released security updates to address a critical vulnerability in Jira Service Management Server and Data Center, tracked as CVE-2023-22501 (CVSS score: 9.4), that could be exploited by an attacker to impersonate another user and gain unauthorized access to other Jira Service Management instances under certain circumstances.

Authentication 98

Authentication Software Hacking Accountability 98

Krebs on Security

OCTOBER 20, 2023

Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Maiffret said BeyondTrust followed up with Okta on Oct. But she said that by Oct.

Social Engineering 362

Social Engineering Engineering Accountability Hacking 362

Security Affairs

DECEMBER 17, 2024

” The Remote Access Trojan (RAT) has been active since July 2022. . “Private sector partners are encouraged to implement the recommendations listed in the Mitigation column of the table below to reduce the likelihood and impact of these attack campaigns.”

Architecture 109

Architecture Internet Internet Malware 109

Thales Cloud Protection & Licensing

JUNE 17, 2024

Guide to Achieving ISO27001:2022 Compliance glenn.hamilton… Tue, 06/18/2024 - 06:01 ISO/IEC 27001:2022 , the latest edition of the internationally recognized standard for information security management systems (ISMS), introduces several significant updates and revisions to address the evolving security challenges that worldwide organizations face.

Encryption 71

Encryption Information Security Authentication Risk 71

Security Affairs

MAY 26, 2022

Below is the list of the four vulnerabilities, the most severe one is a command injection flaw in some CLI commands tracked as CVE-2022-26532 (CVSS v3.1 CVE-2022-0910 : An authentication bypass vulnerability caused by the lack of a proper access control mechanism has been found in the CGI program of some firewall versions.

Firewall 141

Firewall VPN Authentication Cyber Attacks 141

Security Affairs

MAY 23, 2024

Below is the list of the addressed vulnerabilities: CVE Description CVSS Vector CVE-2024-29822 An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Authentication 130

Authentication Hacking Information Security 130

Security Affairs

MARCH 3, 2025

“Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow a remote attacker to bypass authentication or execute arbitrary commands on the underlying operating system of an affected device.” Cisco will not release a fix for this issue.

Small Business 59

Small Business Authentication Hacking Accountability 59

Security Affairs

NOVEMBER 16, 2022

The vulnerabilities discovered by the experts are: CVE-2022-41622 is an unauthenticated remote code execution via cross-site request forgery (CSRF) that impacts BIG-IP and BIG-IQ products. CVE-2022-41800 is an authenticated remote code execution via RPM spec injection that resides in the Appliance mode iControl REST.

Authentication 144

Authentication Hacking Cybersecurity Information Security 144

Security Affairs

OCTOBER 28, 2022

The most severe one is a remote pre-authenticated PHP archive file deserialization vulnerability tracked as CVE-2022-22241 which received a CVSS score of 8.1. ” Other vulnerabilities discovered by the experts are: CVE-2022-22242 : pre-authenticated reflected XSS on the error page.

Authentication 144

Authentication Hacking Information Security 144

Security Affairs

JULY 9, 2022

Four of the fixed issues have been rated as a “high” severity, they are CVE-2022-26117, CVE-2021-43072, CVE-2022-30302, and CVE-2021-41031.

Authentication 144

Authentication Passwords Hacking Accountability 144

Security Affairs

JUNE 17, 2022

China-linked threat actors exploited the zero-day flaw CVE-2022-1040 in Sophos Firewall weeks before it was fixed by the security vendor. On March 25, Sophos announced to have fixed the authentication bypass vulnerability, tracked as CVE-2022-1040, that resides in the User Portal and Webadmin areas of Sophos Firewall.

Firewall 145

Firewall DNS Authentication Malware 145

SecureList

NOVEMBER 23, 2021

For instance, we see a new trend emerging in the criminal ecosystem of spyware-based authentication data theft, with each individual attack being directed at a very small number of targets (from single digits to several dozen). And for some companies, the consequences of a security compromise in 2021 will catch up with them only in 2022.

Spyware 136

Spyware Phishing Cybercrime Energy and Utilities 136

Security Affairs

OCTOBER 12, 2022

Below are the vulnerabilities addressed by Aruba: CVE-2022-37913 and CVE-2022-37914 (CVSS v3.1 – 9.8) Authentication bypass vulnerabilities that resides in the web-based management interface of EdgeConnect Orchestrator. Threat actors can trigger the issue to bypass authentication.

Authentication 133

Authentication Firewall Hacking Information Security 133

Security Affairs

JULY 31, 2022

A vulnerability, tracked as CVE-2022-30563, impacting Dahua IP Camera can allow attackers to seize control of IP cameras. The CVE-2022-30563 vulnerability impacting Dahua IP Camera can allow attackers to seize control of IP cameras. The issue affects Dahua’s implementation of the Open Network Video Interface Forum ( ONVIF ).

Surveillance 145

Surveillance Authentication Telecommunications Manufacturing 145

Security Affairs

AUGUST 19, 2022

Cisco addressed a high-severity escalation of privilege vulnerability ( CVE-2022-20871 ) in AsyncOS for Cisco Secure Web Appliance. Cisco Secure Web Appliance (formerly Secure Web Appliance (WSA)) offers protection from malware and web-based attacks and provides application visibility and control. TBD (Sep 2022) 14.0

Authentication 132

Authentication Hacking Malware Software 132

Security Affairs

DECEMBER 13, 2022

VMware fixed three flaws in multiple products, including a virtual machine escape issue exploited at the GeekPwn 2022 hacking competition. VMware addressed three vulnerabilities in multiple products, including a virtual machine escape flaw, tracked as CVE-2022-31705, that was exploited at the GeekPwn 2022 hacking competition.

Hacking 137

Hacking Authentication Information Security 137

Security Affairs

NOVEMBER 10, 2022

The vulnerability, CVE-2022-0902 (CVSS score: 8.1), is a path-traversal issue that can be exploited by an attacker to inject and execute arbitrary code. “Team82 found a high-severity path-traversal vulnerability (CVE-2022-0902) in ABB’s TotalFlow Flow Computers and Remote Controllers.

Firmware 145

Firmware Passwords Authentication Manufacturing 145

Security Affairs

NOVEMBER 17, 2022

Researchers warn of a surge in cyberattacks targeting CVE-2022-24086, a pre-authentication issue impacting Adobe Commerce and Magento stores. In September 2022, Sansec researchers warned of a surge in hacking attempts targeting a critical Magento 2 vulnerability tracked as CVE-2022-24086.

eCommerce 141

eCommerce Hacking Authentication Technology 141

Security Affairs

JUNE 21, 2022

Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS? Don't worry MS-DFSNM have your back [link] pic.twitter.com/pTHePYLLMs — Filip Dragovic (@filip_dragovic) June 18, 2022.

Authentication 143

Authentication Hacking Cybersecurity Information Security 143

Security Affairs

MARCH 15, 2022

Veeam has released security patches to fix two critical vulnerabilities, tracked as CVE-2022-26500 and CVE-2022-26501 (CVSS score of 9.8), impacting the Backup & Replication solution for virtual environments. CVE-2022-26504 impacts the component used for Microsoft System Center Virtual Machine Manager (SCVMM) integration.

Backups 134

Backups Software Authentication Hacking 134