The Hacker News

MAY 9, 2024

That's according to findings from Juniper Threat Labs, which said the vulnerabilities CVE-2023-46805 and CVE-2024-21887 have been leveraged to deliver the botnet payload. Two recently disclosed security flaws in Ivanti Connect Secure (ICS) devices are being exploited to deploy the infamous Mirai botnet.

Authentication 110

Authentication 110

Security Affairs

MAY 14, 2024

VMware fixed four flaws in its Workstation and Fusion desktop hypervisors, including three zero-days exploited at the Pwn2Own Vancouver 2024 VMware addressed four vulnerabilities in its Workstation and Fusion desktop hypervisors, including three zero-day flaws demonstrated at the Pwn2Own Vancouver 2024. ” reads the advisory. .

Hacking 100

Hacking Information Security 100

Penetration Testing

MAY 7, 2024

Security researchers at Juniper Threat Labs have uncovered a dangerous escalation in attacks targeting Ivanti Connect Secure (ICS) and Ivanti Policy Secure Gateways.

Penetration Testing 94

Penetration Testing Authentication Malware 94

Schneier on Security

SEPTEMBER 17, 2021

Citizen Lab released a report on a zero-click iMessage exploit that is used in NSO Group’s Pegasus spyware. Apple patched the vulnerability; everyone needs to update their OS immediately. News articles on the exploit.

Spyware 304

Spyware 304

Schneier on Security

DECEMBER 20, 2021

Citizen Lab published another report on the spyware used against two Egyptian nationals. According to Citzen Lab: We conducted Internet scanning for Predator spyware servers and found likely Predator customers in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.

Manufacturing 325

Manufacturing Spyware Hacking Internet 325

Penetration Testing

APRIL 23, 2024

A shocking new report by Citizen Lab reveals that popular Chinese keyboard apps transmit your keystrokes in ways that leave them shockingly vulnerable to interception.

Penetration Testing 117

Penetration Testing Passwords 117

Penetration Testing

APRIL 15, 2024

Researchers at Forescout Research – Vedere Labs warn that a sophisticated threat actor is exploiting a critical Fortinet vulnerability to... The post “Connect:fun” Campaign Targets Media Organizations, Exploits Critical Fortinet Vulnerability appeared first on Penetration Testing.

Media 105

Media Penetration Testing 105

Schneier on Security

NOVEMBER 12, 2021

The zero-day exploit was similar to another in-the-wild vulnerability analyzed by another Google researcher in the past, according to the report. In addition, the zero-day exploit used in this hacking campaign is “identical” to an exploit previously found by cybersecurity research group Pangu Lab, Huntley said.

Hacking 299

Hacking Malware Cybersecurity 299

Penetration Testing

APRIL 16, 2024

Cybersecurity experts at FortiGuard Labs are sounding the alarm about a wave of attacks targeting a known vulnerability in TP-Link Archer AX21 routers.

Penetration Testing 111

Penetration Testing Cybersecurity 111

Penetration Testing

MARCH 12, 2024

Security researchers Quynh Le and Eng De Sheng from Ensign InfoSecurity Labs have uncovered a major security flaw (CVE-2024-25331) in the popular D-Link DIR-822 router.

Penetration Testing 117

Penetration Testing 117

Schneier on Security

NOVEMBER 30, 2021

This creates a long tail of old products that remain in widespread use, vulnerable to attacks. Intel’s answer to this conundrum was to create a warehouse and laboratory in Costa Rica, where the company already had a research-and-development lab, to store the breadth of its technology and make the devices available for remote testing.

Technology 281

Technology Engineering Software Cybersecurity 281

Penetration Testing

JANUARY 31, 2024

Recently, Docker faced a significant challenge as Snyk Labs identified four critical security vulnerabilities affecting its container... The post CVE-2024-21626: Docker Confronts Critical Container Escape Threat appeared first on Penetration Testing.

Penetration Testing 145

Penetration Testing Technology 145

Security Affairs

APRIL 16, 2024

Researchers released an exploit code for the actively exploited vulnerability CVE-2024-3400 in Palo Alto Networks’ PAN-OS. is a critical command injection vulnerability in Palo Alto Networks PAN-OS software. is a critical command injection vulnerability in Palo Alto Networks PAN-OS software. This flaw impacts PAN-OS 10.2,

Firewall 118

Firewall Hacking Software Cybersecurity 118

Security Affairs

MARCH 22, 2024

The researcher Seunghyun Lee ( @0x10n ) of KAIST Hacking Lab used a UAF to achieve remote code execution in the renderer on both Micosoft Edge and Google Chrome. The team from STAR Labs SG demonstrated the first Docker desktop escape at Pwn2Own hacking competition by chaining two vulnerabilities, including a UAF.

Hacking 127

Hacking Information Security 127

The Hacker News

APRIL 24, 2024

Security vulnerabilities uncovered in cloud-based pinyin keyboard apps could be exploited to reveal users' keystrokes to nefarious actors. The findings come from the Citizen Lab, which discovered weaknesses in eight of nine apps from vendors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi.

99

99

Security Affairs

NOVEMBER 20, 2023

The DarkCasino APT group leveraged a recently disclosed WinRAR zero-day vulnerability tracked as CVE-2023-38831. Researchers at cybersecurity firm NSFOCUS analyzed DarkCasino attack pattern exploiting the WinRAR zero-day vulnerability tracked as CVE-2023-38831. ” reads the report published by NSFOCUS.

Phishing 134

Phishing Financial Services Cryptocurrency Technology 134

Security Boulevard

DECEMBER 18, 2023

In a recent scrutiny of Sierra wireless routers, Forescout’s Vedere Labs uncovered 21 novel vulnerabilities that, though relatively straightforward to exploit, pose historical challenges for enterprises to rectify. The post Sierra Flaws Cyber Attack: Router Vulnerabilities Unveiled appeared first on Security Boulevard.

Cyber Attacks 64

Cyber Attacks Wireless Internet Internet 64

Security Affairs

MAY 10, 2024

Since the start of the year, Google released an update to fix the fifth actively exploited zero-day vulnerability in the Chrome browser. The vulnerability is the fifth zero-day flaw in the Google browser that is exploited in the wild since the start of the year. Manfred Paul demonstrated the vulnerability during the Pwn2Own 2024.

Engineering 114

Engineering Hacking Information Security 114

Security Affairs

MAY 9, 2024

Threat actors exploit recently disclosed Ivanti Connect Secure (ICS) vulnerabilities to deploy the Mirai botnet. Researchers from Juniper Threat Labs reported that threat actors are exploiting recently disclosed Ivanti Connect Secure (ICS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 to drop the payload of the Mirai botnet.

Authentication 96

Authentication Backups Cyber threats Malware 96

Security Affairs

MAY 14, 2024

Google released emergency security updates to address an actively exploited Chrome zero-day vulnerability. Google has released emergency security updates to address a high-severity zero-day vulnerability vulnerability, tracked as CVE-2024-4761, in the Chrome browser. 208 for Mac/Windows and 124.0.6367.207 for Linux.

Engineering 115

Engineering Hacking Information Security 115

Security Affairs

SEPTEMBER 11, 2023

CISA adds vulnerabilities in Apple devices exploited to install NSO Group’s Pegasus spyware on iPhones to Known Exploited Vulnerabilities Catalog US Cybersecurity and Infrastructure Security Agency (CISA) added the security vulnerabilities chained in the zero-click iMessage exploit BLASTPASS to its Known Exploited Vulnerabilities Catalog.

Spyware 111

Spyware Accountability Hacking Risk 111

Penetration Testing

JANUARY 11, 2024

The Linux Kernel has been hit by a significant security vulnerability, CVE-2023-6040, with a CVSS score of 7.8, Discovered by Lin Ma from Ant Security Light-Year Lab, this flaw arises... The post CVE-2023-6040: A Critical Linux Kernel Netfilter Vulnerability appeared first on Penetration Testing.

Penetration Testing 110

Penetration Testing 110

Penetration Testing

MARCH 19, 2024

Rhino Security Labs published the technical details and proof-of-concept (PoC) exploit for a severe flaw in Progress Kemp LoadMaster load balancers (CVE-2024-1212, CVSS 10).

Penetration Testing 107

Penetration Testing 107

Security Affairs

MAY 16, 2024

Google released security updates to address a new actively exploited Chrome zero-day vulnerability, the third in a week. Google has released a new emergency security update to address a new vulnerability, tracked as CVE-2024-4947, in the Chrome browser, it is the third zero-day exploited in attacks that was disclosed this week.

Engineering 97

Engineering Hacking Information Security 97

Krebs on Security

OCTOBER 10, 2023

Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. The latter vulnerability could expose NTLM hashes , which are used for authentication in Windows environments. and iPadOS 17.0.3

Engineering 223

Engineering DDOS Software Authentication 223

Schneier on Security

JULY 12, 2022

Honda vehicles from 2021 to 2022 are vulnerable to this attack : On Thursday, a security researcher who goes by Kevin2600 published a technical report and videos on a vulnerability that he claims allows anyone armed with a simple hardware device to steal the code to unlock Honda vehicles.

Software 326

Software Cybersecurity 326

Security Affairs

MARCH 27, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the 2023 Pwn2Own to its Known Exploited Vulnerabilities catalog. The Star Labs team demonstrated the vulnerability at the Pwn2Own Vancouver 2023 hacking competition.

Hacking 113

Hacking Authentication Cybersecurity Risk 113

Security Affairs

SEPTEMBER 7, 2023

Citizen Lab reported that the actively exploited zero-days fixed by Apple are being used in Pegasus spyware attacks Researchers at Citizen Lab reported that the actively exploited zero-day flaws (CVE-2023-41064 and CVE-2023-41061) fixed by Apple are being used to infect devices with NSO Group ’s Pegasus spyware.

Spyware 109

Spyware Accountability Hacking Mobile 109

Penetration Testing

JANUARY 18, 2024

Recently, Cado Security Labs researchers have uncovered a striking and innovative campaign that specifically targets vulnerable Docker services.

Penetration Testing 100

Penetration Testing Malware Cyber threats 100

Security Affairs

APRIL 28, 2024

A hacking campaign targeted Ukraine exploiting a seven-year-old vulnerability in Microsoft Office to deliver Cobalt Strike. Security experts at Deep Instinct Threat Lab have uncovered a targeted campaign against Ukraine, exploiting a Microsoft Office vulnerability dating back almost seven years to deploy Cobalt Strike on compromised systems.

VPN 110

VPN Hacking Engineering Information Security 110

Penetration Testing

JANUARY 18, 2024

In a recent discovery, Varonis Threat Labs has unveiled three new ways that cyber attackers can exploit to access NTLM v2 hashed passwords, putting countless systems and user data at risk.

Passwords 111

Passwords Penetration Testing Cyber Attacks Risk 111

Malwarebytes

JUNE 9, 2022

After a decent amount of pressure, Owl Labs has finally released updates for vulnerabilities in Meeting Owl, and Whiteboard Owl cameras. Owl Labs makes 360-degree video conferencing equipment for classrooms and boardrooms. And these vulnerabilities were not minor. The vulnerabilities. The research.

Authentication 85

Authentication Passwords Software Wireless 85

Penetration Testing

FEBRUARY 12, 2024

In the wake of Atlassian’s disclosure of CVE-2023-22527, a critical template injection vulnerability in the Confluence Server and Data Center, Arctic Wolf Labs has uncovered threat actors are leveraging this vulnerability to deploy the... The post C3RB3R Ransomware Strikes Again: Exploiting the Confluence Vulnerability appeared first (..)

Penetration Testing 81

Penetration Testing Ransomware Malware 81

Security Affairs

SEPTEMBER 13, 2023

Mozilla addressed a critical zero-day vulnerability in Firefox and Thunderbird that has been actively exploited in attacks in the wild. Mozilla rolled out security updates to address a critical zero-day vulnerability, tracked as CVE-2023-4863 , in Firefox and Thunderbird that has been actively exploited in the wild. Firefox ESR 115.2.1,

Spyware 119

Spyware Architecture Engineering Hacking 119

Penetration Testing

DECEMBER 15, 2023

Two vulnerabilities in Microsoft SharePoint Server have recently come under the spotlight, thanks to the detailed work of STAR Labs researcher Nguyễn Tiến Giang (Jang).

Penetration Testing 112

Penetration Testing 112

Penetration Testing

APRIL 25, 2024

Researchers at Rhino Security Labs have detailed a critical security flaw in Progress Flowmon, a widely used network monitoring tool.

Penetration Testing 79

Penetration Testing 79

Bleeping Computer

MAY 18, 2023

LayerZero Labs has launched a bug bounty on the Immunefi platform that offers a maximum reward of $15 million for critical smart contract and blockchain vulnerabilities, a figure that sets a new record in the crypto space. [.]

119

119