Security Affairs

OCTOBER 21, 2024

The Internet Archive was breached again, attackers hacked its Zendesk email support platform through stolen GitLab authentication tokens. Internet Archive Zendesk emails sent by the threat actor Source: BleepingComputer The message highlights a poor security posture by the Internet Archive.

Internet 130

Internet Internet Data breaches Authentication 130

Security Affairs

FEBRUARY 19, 2025

The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user. Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025.

Firewall 107

Firewall Authentication Architecture Internet 107

The Last Watchdog

DECEMBER 18, 2024

This shift is expected to place significant pressure on organizations that haven’t yet developed trusted data to manage risk effectively. Sherrets Dane Sherrets , Innovation Architect, HackerOne Well see greater industry adoption of AI security and safety standards. Failure risks fines or supplier bans.

Cybersecurity 130

Cybersecurity CISO Risk Government 130

Security Affairs

FEBRUARY 15, 2025

. “Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted andtake immediate steps to secure them.“ An unauthenticated attacker on the network couple exploit the vulnerability to bypass authentication and invoke certain PHP scripts. ” reads the report published by Assetnote.

Firewall 104

Firewall Authentication Architecture Risk 104

Security Affairs

OCTOBER 19, 2024

Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Overlapping indicators link these cases to prior Fog and Akira ransomware attacks.

Backups 132

Backups VPN Ransomware Authentication 132

Security Affairs

NOVEMBER 26, 2024

Attackers can exploit the SSL VPN gateway by accessing the filesystem via an HTTP header flags attribute and a vulnerable URL without authentication. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. ” reads the advisory. ” reads the advisory.

VPN 112

VPN Authentication Hacking Risk 112

Thales Cloud Protection & Licensing

SEPTEMBER 13, 2021

Authentication and access management increasingly perceived as core to Zero Trust Security. While many consider that remote access to corporate resources and data as the key disruption, security teams had to face many more challenges. State of Multi-Factor Authentication. Simplicity is always an ally of security.

Authentication 153

Authentication Cloud Migration IoT Technology 153

Security Affairs

JANUARY 8, 2025

SonicWall warns customers to address an authentication bypass vulnerability in its firewall’s SonicOS that is “susceptible to actual exploitation.” “The list of all security advisories and the associated list of vulnerabilities is below. ” “We have identified a high (CVE Score 8.2)

Firewall 116

Firewall Firmware VPN Authentication 116

Security Affairs

JULY 29, 2022

Therefore, strong authentication methods are needed. Therefore, strong authentication methods are needed to improve security without hindering user convenience. What is Strong Authentication? The IAM Security Boundary Strong authentication is a critical component of modern-day identity and access management.

Authentication 127

Authentication Passwords Data privacy Identity Theft 127

Security Affairs

JANUARY 30, 2025

.” The researchers noted that the leak could have allowed attackers to take full control of the database and potentially escalate privileges within the DeepSeek environment, without any authentication. “This level of access posed a critical risk to DeepSeeks own security and for its end-users.

Authentication 122

Authentication Passwords Hacking Risk 122

Security Affairs

APRIL 7, 2025

Guidebooks are also available to instruct on how to exploit the information obtained, in order to more effectively target victims through social engineering and doxxing campaigns. The lack of a robust verification process, combined with the trust placed in authorities, increases the risk to users’ digital security and privacy.

Cybercrime 140

Cybercrime Social Engineering Accountability Government 140

Security Affairs

JANUARY 31, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds Apple improper authentication bug to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple improper authentication bug, tracked as CVE-2022-48618 , to its Known Exploited Vulnerabilities (KEV) catalog.

Authentication 135

Authentication Risk Cybersecurity Information Security 135

Security Affairs

NOVEMBER 19, 2024

CVE-2024-0012 is a vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass authentication and gain administrator privileges. This access enables administrative actions, configuration tampering, or exploitation of other vulnerabilities like CVE-2024-9474.

Authentication 110

Authentication Firewall Risk Hacking 110

Security Affairs

DECEMBER 6, 2024

Cybersecurity and Infrastructure Security Agency (CISA)added the CyberPanelflaw CVE-2024-51378 (CVSS score: 10.0) Remote attackers could bypass authentication and execute arbitrary commands by exploiting a flaw in secMiddleware , which only validates POST requests. to its Known Exploited Vulnerabilities (KEV) catalog. and ftp/views.py.

DNS 110

DNS Authentication Ransomware Hacking 110

The Last Watchdog

DECEMBER 5, 2024

5, 2024, CyberNewswire — One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management (PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the industrys leading information security magazine. Alisa Viejo, Calif.,

InfoSec 130

InfoSec Cyber Risk CISO Cybersecurity 130

Security Affairs

JUNE 10, 2025

. “RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.” ” The flaw resides in SAP’s Remote Function Call (RFC) framework lets authenticated attackers bypass key checks and escalate privileges, risking app integrity and availability.

Authentication 102

Authentication Hacking Software Risk 102

Security Affairs

MARCH 18, 2025

The vulnerability is an authentication bypass issue that could allow a remote attacker to gain super-admin privileges by making maliciously crafted CSF proxy requests. An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0

Authentication 117

Authentication Ransomware Firewall Hacking 117

The Last Watchdog

DECEMBER 31, 2019

Related: Good to know about IoT Physical security is often a second thought when it comes to information security. Despite this, physical security must be implemented correctly to prevent attackers from gaining physical access and taking whatever they desire.

Cyber Risk 173

Cyber Risk Risk Firewall Surveillance 173

Security Affairs

NOVEMBER 5, 2024

is an inadequate authentication mechanisms that could allow an attacker to access sensitive information like usernames, MD5 password hashes, and configuration data. Attackers can also trigger flaws to extract network details to infiltrate connected systems, increasing the risk of data breaches and ransomware attacks.

Firmware 127

Firmware Manufacturing Authentication IoT 127

SecureWorld News

DECEMBER 12, 2024

Trey Ford, Chief Information Security Officer at Bugcrowd, observed, "This incident may not have been made public if it wasn't for the Form 8-K requirement." To mitigate such risks, organizations must adopt proactive measures.

Password Management 109

Password Management Passwords CISO Cybersecurity 109

Security Affairs

MAY 29, 2024

This method poses a risk of exposing sensitive data or enabling fraudulent activities. The advisory published by the company states that the attacks targeted the endpoints supporting the cross-origin authentication feature, the attacks hit several customers. ” reads advisory. ” reads advisory.

Authentication 127

Authentication Accountability Passwords Data breaches 127

Security Affairs

FEBRUARY 7, 2025

“Successful exploitation of this vulnerability could allow an authenticated user to perform a remote code execution.” “This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.”

Authentication 94

Authentication Internet Internet Hacking 94

Security Affairs

JANUARY 24, 2025

This week, SonicWall warned customers of a critical security vulnerability, tracked as CVE-2025-23006 (CVSS score of 9,8) impacting its Secure Mobile Access (SMA) 1000 Series appliances. reads the advisory.

Authentication 98

Authentication Mobile Hacking Cybersecurity 98

Security Affairs

NOVEMBER 2, 2024

is an inadequate authentication mechanisms that could allow an attacker to access sensitive information like usernames, MD5 password hashes, and configuration data. Attackers can also trigger flaws to extract network details to infiltrate connected systems, increasing the risk of data breaches and ransomware attacks.

Firmware 123

Firmware Manufacturing IoT Healthcare 123

Security Affairs

JUNE 11, 2025

These campaigns show how unpatched systems remain at serious risk, especially for high-value targets. An attacker can exploit the flaw to take control of affected systems and run malicious code, putting users and organizations at significant risk. Last week, the critical flaw CVE-2025-49113 (CVSS score of 9.9) x before 1.6.11

Authentication 78

Authentication Internet Internet Risk 78

Security Affairs

FEBRUARY 26, 2025

A remote authenticated attacker could exploit the vulnerability to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. The vulnerability was addressed inJuly 2023with version 8.8.15 Patch 40. . ” reads the advisory published by Microsoft.

Authentication 103

Authentication Hacking Cybersecurity Risk 103

SecureList

DECEMBER 9, 2024

This incident serves as a stark reminder of the critical risks posed by global IT disruptions and supply chain weaknesses. A previous faulty update had already suggested broader problems with CrowdStrike’s security software at the time, though the problem didn’t receive that much publicity. million systems worldwide.

Internet 111

Internet Internet Risk Social Engineering 111

Security Affairs

NOVEMBER 15, 2024

Below are the descriptions of the flaws addressed by the security firm: CVE-2024-9463 (CVSS 9.9) – A command injection vulnerability in Palo Alto Networks’ Expedition allows unauthenticated attackers to execute OS commands as root, exposing usernames, passwords, configurations, and API keys of PAN-OS firewalls.

Firewall 110

Firewall Passwords Authentication Phishing 110

Security Affairs

OCTOBER 24, 2024

The vulnerability is a missing authentication issue in FortiManager and FortiManager Cloud versions, an attacker could execute arbitrary code or commands through specially crafted requests. “A ” To mitigate the risks associated with the exploitation of this FortiManager vulnerability, several strategies can be implemented.

Authentication 133

Authentication Internet Internet Hacking 133

Security Affairs

SEPTEMBER 22, 2021

Researchers found multiple flaws in widely used network management products from Nagios that pose serious risk to organizations. AutoDiscovery component and could lead to post-authenticated RCE under the security context of the user running Nagios. The vendor released patches for each of the impacted products in August.

Risk 137

Risk Authentication Hacking Accountability 137

Security Affairs

APRIL 5, 2025

Only phone numbers and timestamps were at risk. It offers features like spam detection, automatic blocking of high-risk spam calls, and the ability to report unwanted numbers. With access to call history, attackers can map routines, contacts, and movements, risking the safety of whistleblowers, journalists, dissidents, and others.

Wireless 106

Wireless Surveillance Risk Media 106

Security Affairs

APRIL 29, 2025

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: “Webservers can be compromised through bad actors creating and executing webshells.”

Authentication 106

Authentication Hacking Cybersecurity Risk 106

SecureWorld News

MARCH 13, 2025

While the AI-generated malware in this case required manual intervention to function, the fact that these systems can produce even semi-functional malicious code is a clear signal that security teams need to adapt their strategies to account for this emerging threat vector."

Malware 112

Malware Cybersecurity Cyber threats Threat Detection 112

SecureWorld News

JULY 3, 2024

However, this trend also introduces significant data security risks that cannot be overlooked. To navigate the complexities of global talent outsourcing while safeguarding valuable data, organizations must adopt a proactive and comprehensive approach to risk mitigation. Unauthorized access to sensitive data 1.

Risk 111

Risk Data breaches Penetration Testing Encryption 111

Security Affairs

APRIL 18, 2025

RPAC (CVE-2025-31201) An attacker with read/write access could bypass Pointer Authentication on iOS. Security patches are available for the following devices: iPhone XS and later, iPad Pro 13-inch, iPad Pro 13.9-inch The company acknowledged Googles TAG (Threat Analysis Group) for reporting this flaw. ” Microsoft warns.

Authentication 103

Authentication Surveillance Passwords Media 103

Security Affairs

JANUARY 15, 2025

Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiOS authorization bypass vulnerability, tracked as CVE-2024-55591 (CVSS score: 9.6) Remote attackers can exploit the vulnerability to bypass authentication and gain super-admin access via crafted Node.js to its Known Exploited Vulnerabilities (KEV) catalog.

Authentication 104

Authentication Hacking Cybersecurity Risk 104

Security Affairs

JANUARY 15, 2025

Instead, only an HMAC (hash-based message authentication code) is logged in AWS CloudTrail. We also thoroughly investigate all reports of exposed keys and quickly take any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment. Halcyon continues.

Encryption 119

Encryption Ransomware Authentication Accountability 119