Security Affairs

NOVEMBER 21, 2024

Threat actors already hacked thousands of Palo Alto Networks firewalls exploiting recently patched zero-day vulnerabilities. CVE-2024-0012 is a vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass authentication and gain administrator privileges.

Firewall 113

Firewall Hacking VPN Authentication 113

Krebs on Security

JULY 8, 2021

The attackers exploited a vulnerability in software from Kaseya , a Miami-based company whose products help system administrators manage large networks remotely. “It’s a patch for their own software. “This is worse because the CVE calls for an authenticated user,” Holden said. And it’s not zero-day.

Software 331

Software Ransomware System Administration Authentication 331

Krebs on Security

FEBRUARY 26, 2023

Media coverage understandably focused on GoDaddy’s admission that it suffered three different cyberattacks over as many years at the hands of the same hacking group. The key works without the need for any special software drivers. Thus, the second factor cannot be phished, either over the phone or Internet.

Hacking 332

Hacking Social Engineering Phishing Scams 332

Security Affairs

FEBRUARY 20, 2025

The company pointed out that only authenticated users with existing access to the NetScaler Console can exploit this vulnerability. “The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization. NetScaler Console 14.1

Authentication 120

Authentication Software Hacking Information Security 120

Security Affairs

JUNE 4, 2025

These issues could allow remote code execution, authentication bypass, data leaks, and more. “Potential security vulnerabilities have been identified in HPE StoreOnce Software.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,Hewlett Packard Enterprise)

Software 64

Software Backups Authentication Hacking 64

Security Affairs

JUNE 14, 2025

The most severe vulnerability, tracked as CVE-2025-4232 (CVSS score of 7.1), is an authenticated code injection through wildcard on macOS. The company also addressed a PAN-OS Authenticated Admin Command Injection Vulnerability, tracked as CVE-2025-4231 (CVSS score of 6.1), in the Management Web Interface. ” reads the advisory.

Authentication 108

Authentication Hacking Software Risk 108

Security Affairs

JUNE 4, 2025

has been discovered in the Roundcube webmail software. allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.” A critical flaw, tracked as CVE-2025-49113 (CVSS score of 9.9) x before 1.6.11

Authentication 116

Authentication Risk Hacking Technology 116

The Last Watchdog

AUGUST 29, 2023

The threat of bad actors hacking into airplane systems mid-flight has become a major concern for airlines and operators worldwide. Back in 2015, a security researcher decided to make that very point when he claimed to have hacked a plane , accessed the thrust system, and made it fly higher than intended.

Software 264

Software Risk Artificial Intelligence Cyber Attacks 264

Security Affairs

APRIL 1, 2025

Threat actors are exploiting a critical authentication bypass vulnerability, tracked as CVE-2025-2825 , in the CrushFTP file transfer software. The file transfer software maker CrushFTP urge customers to take immediate action to address the vulnerability. The vulnerability impacts CrushFTP versions 10.0.0 through 10.8.3

Authentication 119

Authentication Software Ransomware Hacking 119

Security Affairs

OCTOBER 19, 2024

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. Some of these VPNs were running unsupported software versions.” reads the advisory.

Backups 132

Backups VPN Ransomware Authentication 132

Krebs on Security

SEPTEMBER 13, 2023

Info-stealers like RedLine typically are deployed via opportunistic email malware campaigns, and by secretly bundling the trojans with cracked versions of popular software titles made available online. Also, unless you really know what you’re doing, please don’t download and install pirated software. Microsoft Corp.

Cybercrime 344

Cybercrime Passwords Authentication Malware 344

The Last Watchdog

JANUARY 25, 2021

SolarWinds and Mimecast are long-established, well-respected B2B suppliers of essential business software embedded far-and-wide in company networks. Thanks to a couple of milestone hacks disclosed at the close of 2020 and start of 2021, they will forever be associated with putting supply-chain vulnerabilities on the map.

Hacking 228

Hacking B2B Authentication Software 228

Security Affairs

OCTOBER 11, 2024

.” The Internet Archive is an American nonprofit digital library website that provides free access to collections of digitized materials including websites, software applications, music, audiovisual, and print materials. Starting from Wednesday, the website archive.org was displaying a message informing visitors that it was hacked.

Data breaches 123

Data breaches Internet Internet DDOS 123

Krebs on Security

FEBRUARY 10, 2020

Justice Department today unsealed indictments against four Chinese officers of the People’s Liberation Army (PLA) accused of perpetrating the 2017 hack against consumer credit bureau Equifax that led to the theft of personal data on nearly 150 million Americans.

Hacking 320

Hacking Identity Theft Government Phishing 320

Krebs on Security

DECEMBER 18, 2020

government cybersecurity agencies warned this week that the attackers behind the widespread hacking spree stemming from the compromise at network software firm SolarWinds used weaknesses in other, non-SolarWinds products to attack high-value targets. National Security Agency (NSA) warned on Dec. ” Indeed, the NSA’s Dec.

Software 363

Software Authentication Hacking Government 363

Security Affairs

OCTOBER 29, 2024

The two infostealers allowed operators to harvest usernames, passwords, contact info, and crypto-wallets from victims, the threat actors sold this data to criminals for financial theft and hacking. Update software : Keep your operating system, security software, and firewall up to date to patch vulnerabilities.

Identity Theft 127

Identity Theft Passwords Malware Banking 127

Security Affairs

DECEMBER 11, 2024

Ivanti addressed a critical authentication bypass vulnerability impacting its Cloud Services Appliance (CSA) solution. Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-11639 (CVSS score of 10), in its Cloud Services Appliance (CSA) solution. that the software firm addressed in September.

Authentication 106

Authentication Software Hacking Information Security 106

Security Affairs

APRIL 22, 2025

Japan s Financial Services Agency (FSA) warns of hundreds of millions in unauthorized trades linked to hacked brokerage accounts. Keeping devices updated and using reliable antivirus software also helps prevent malware-related data theft. from fake websites (phishing sites) disguised as websites of real securities companies.”

Financial Services 121

Financial Services Passwords Accountability Antivirus 121

Security Affairs

MAY 5, 2025

Sansec researchers reported that multiple vendors were hacked in a coordinated supply chain attack, the experts discovered that a backdoor was hidden in 21 applications. “Hundreds of stores, including a $40 billion multinational, are running backdoored versions of popular ecommerce software. ” continues the report.

eCommerce 96

eCommerce Hacking Authentication Software 96

Security Affairs

FEBRUARY 19, 2025

The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user. Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025. In November 2024, the U.S.

Firewall 107

Firewall Authentication Architecture Internet 107

Security Affairs

NOVEMBER 9, 2024

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. Some of these VPNs were running unsupported software versions.” reads the advisory.

Backups 134

Backups Ransomware VPN Accountability 134

Security Affairs

JUNE 10, 2025

. “RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.” ” The flaw resides in SAP’s Remote Function Call (RFC) framework lets authenticated attackers bypass key checks and escalate privileges, risking app integrity and availability.

Authentication 102

Authentication Hacking Software Risk 102

Krebs on Security

AUGUST 2, 2019

Evan Johnson , manager of the product security team at Cloudflare , recently penned an easily digestible column on the Capital One hack and the challenges of detecting and blocking SSRF attacks targeting cloud services. “SSRF has become the most serious vulnerability facing organizations that use public clouds,” Johnson wrote.

Hacking 275

Hacking Firewall Data breaches Software 275

Security Affairs

DECEMBER 27, 2024

Palo Alto Networks addressed a high-severity flaw, tracked as CVE-2024-3393 (CVSS score: 8.7), in PAN-OS software that could cause a denial-of-service (DoS) condition. when access is limited to authenticated end users via Prisma Access. Repeated exploitation forces the firewall into maintenance mode. ” reads the advisory.

DNS 114

DNS Firewall Spyware Software 114

Security Affairs

OCTOBER 24, 2024

An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking , CISCO ASA) “This vulnerability is due to resource exhaustion. ” reads the advisory.

VPN 124

VPN Firewall Passwords Software 124

Security Affairs

MARCH 11, 2024

Researchers released technical specifics and a PoC exploit for a recently disclosed flaw in Progress Software OpenEdge Authentication Gateway and AdminServer. ” The vulnerability CVE-2024-1403 (CVSS score 10) is an authentication bypass issue that impacts OpenEdge versions 11.7.18 Researchers from Horizon3.ai

Software 138

Software Authentication Passwords Engineering 138

Security Affairs

DECEMBER 30, 2024

Cisco confirmed the authenticity of the 4GB of leaked data, the data was compromised in a recent security breach, marking the second leak in the incident. Cisco confirmed the authenticity of the 4GB of leaked data, which was compromised in a recent security breach, marking it as the second leak in the incident.

Data breaches 126

Data breaches Cybercrime Authentication Technology 126

Hacker's King

JANUARY 8, 2025

You may also like to read: How Hackers Spy On Hacked Phone? How To Detect and Secure Yourself Hacker's Most Preferred Hacking Techniques These techniques can be described as the most liked techniques of users to hack Android devices. By using this technique, hackers extract any information required to hack your Android device.

Hacking 52

Hacking Spyware Antivirus Passwords 52

Security Affairs

FEBRUARY 15, 2025

“ An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. ” reads the report published by Assetnote.

Firewall 104

Firewall Authentication Architecture Risk 104

Security Affairs

MARCH 10, 2025

Moonstone Sleet threat actors target financial and cyberespionage victims using trojanized software, custom malware, malicious games, and fake companies like StarGlow Ventures and C.C. Additionally, they attempt to infiltrate organizations by posing as software developers seeking employment.

Ransomware 120

Ransomware Healthcare VPN Malware 120

Security Affairs

MAY 22, 2024

A critical security vulnerability in Veeam Backup Enterprise Manager could allow threat actors to bypass authentication. A critical vulnerability, tracked as CVE-2024-29849 (CVSS score: 9.8), in Veeam Backup Enterprise Manager could allow attackers to bypass authentication.

Backups 132

Backups Authentication Accountability Software 132

Security Affairs

NOVEMBER 19, 2024

CVE-2024-0012 is a vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass authentication and gain administrator privileges. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, CISA )

Authentication 110

Authentication Firewall Risk Hacking 110

Krebs on Security

SEPTEMBER 2, 2021

The data in this story come from a trusted source in the security industry who has visibility into a network of hacked machines that fraudsters in just about every corner of the Internet are using to anonymize their malicious Web traffic. mail server responds “OK” = successful access).

Accountability 349

Accountability Authentication Passwords Hacking 349

Security Affairs

FEBRUARY 7, 2025

Trimble Cityworks is a GIS-centric asset management and permitting software designed for local governments, utilities, and public works organizations. “Successful exploitation of this vulnerability could allow an authenticated user to perform a remote code execution.” ” reads the CISA’s advisory.

Authentication 94

Authentication Internet Internet Government 94

Security Affairs

NOVEMBER 15, 2024

Glove Stealer is a.NET-based information stealer that targets browser extensions and locally installed software to steal sensitive data. The malware could harvest a huge trove of data from infected systems, including cookies, autofill, cryptocurrency wallets, 2FA authenticators, password managers, and email client information.

Encryption 118

Encryption Password Management Cryptocurrency Social Engineering 118

Security Affairs

DECEMBER 5, 2024

Cisco released security patches for a vulnerability, tracked as CVE-2024-20397 (CVSS score of 5.2), in the NX-OS softwares bootloader that could be exploited by attackers to bypass image signature verification. “A successful exploit could allow the attacker to bypassNX-OSimage signature verificationand loadunverified software.”

Software 84

Software Authentication Hacking Information Security 84

Hacker's King

NOVEMBER 16, 2024

How the Hack Works Many modern cars, including those from Kia, use telematics systems that connect to mobile apps and cloud-based services for convenience features like remote start or door unlocking. The company is working on updating its software and strengthening encryption to protect against unauthorized access.

Hacking 52

Hacking Mobile Encryption Authentication 52