article thumbnail

Weekly Vulnerability Recap – August 21, 2023 – When ACE Equals Bad

eSecurity Planet

Here’s a roundup of the week’s major vulnerabilities that security teams should mitigate or patch. A few small errors in the implementation of AES Encryption allows for unauthenticated ACE, and the security firm GreyNoise notes a significant spike in attackers trying to exploit this vulnerability.

article thumbnail

Weekly Vulnerability Recap – November 6, 2023 – Windows Drivers and Exchange Flaws

eSecurity Planet

30, 2023 NGINX Ingress Controller for Kubernetes Flaws Can Lead to Credential Theft Type of Attack: Path sanitization bypass and injection vulnerabilities discovered in the NGINX Ingress controller can allow for credential theft, arbitrary command execution, and critical data access. CVE-2023-5044 (Code Injection): This CVSS score 7.6

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

VulnRecap 1/8/24 – Ivanti EPM & Attacks on Old Apache Vulnerabilities

eSecurity Planet

The new year brought few new vulnerabilities, and only Ivanti Endpoint Manager (EPM) and Kyber, the quantum resistant encryption algorithm, publicized new vulnerabilities or fixes. Speed remains critical to security, but more importantly, patching teams need to make progress with patch and vulnerability management. Versions 0.65

article thumbnail

Weekly Vulnerability Recap – August 14, 2023 – Old or New, Vulnerabilities Need Management

eSecurity Planet

Here’s a roundup of the week’s major vulnerabilities that security teams should mitigate or patch. August 12 , 2023 Ford Auto’s TI Wi-Fi Vulnerability The Internet of Things (IoT) continues to expand and become a threat to connected businesses. Adobe also updated their Commerce and Dimension software.

article thumbnail

Why BYOD Is the Favored Ransomware Backdoor

eSecurity Planet

These devices exist outside of direct corporate management and provide a ransomware gang with unchecked platforms for encrypting data. Ransomware remains just one of many different threats and as security teams eliminate key vectors of attack, adversaries will shift tactics. How does remote encryption work?

article thumbnail

SandboxAQ Open Sources Cryptography Management Tool for Post-Quantum Era

eSecurity Planet

With its Alphabet origins and former Google CEO Eric Schmidt as chairman, SandboxAQ landed a $500 million funding round earlier this year, the biggest cybersecurity round of 2023 thus far, with an A-list of investors that includes Schmidt, Salesforce CEO Marc Benioff, T. Also read: The U.S.

article thumbnail

VulnRecap 1/22/24 – Watch Chrome, Ivanti, Citrix Issues

eSecurity Planet

Affected keys included some encryption keys and the GitHub commit signing key. To encrypt GitHub Actions , GitHub Codespaces , and Dependabot secrets, take the new public keys from the API. CVE-2023-6548 is a remote code execution vulnerability for an authenticated user, and CVE-2023-6549 is a denial-of-service vulnerability.