Vulnerabilities

On a report titled “Surge on Web defacement and web application related vulnerabilities targeting Bangladesh” BGD e-GOV CIRT said, web defacement attacks and the exploitation of web application vulnerabilities are a growing trend in Bangladesh. These weaknesses can be used for phishing attacks, spreading malware, and creating backdoors for continuous …

CISA added 2 new vulnerabilities to its catalog of known exploited vulnerabilities, because they have proof that these vulnerabilities are being actively exploited. CVE-2024-4610 ARM Mali GPU Kernel Driver Use-After-Free Vulnerability:  Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a …

The Dutch military security service MIVD recently revealed that a cyber espionage campaign, which was initially mentioned in February, managed to gain access to around 20,000 Fortigate-secured systems between 2022 and 2023. It is now believed that this campaign “appears to be much more extensive than previously known”. The Nationaal Cyber Security …

Bitdefender fixed a serious vulnerability (CVE-2024-4177, CVSS 8.1) in its GravityZone Console On-Premise product. This flaw, found by security researcher Nicolas Verdier (n1nj4sec), could enable attackers to carry out server-side request forgery (SSRF) attacks, possibly resulting in unauthorized access and data breaches. GravityZone Console is a security management platform by …

SolarWinds released updates to fix several security issues in Serv-U and the SolarWinds Platform. These vulnerabilities impact Platform 2024.1 SR 1 and older versions. The company fixed a security issue, known as CVE-2024-28996, reported by a penetration tester from NATO. NATO Communications and Information Agency pentester Nils Putnins discovered a …

The very month May-2024 is observed a significant increase in cybersecurity vulnerabilities across various software and operating systems. Many of these vulnerabilities have the potential to be exploited by malicious actors, posing a serious risk to organizations and individuals alike. It is crucial for organizations to stay vigilant and prioritize …

Zyxel has released patches addressing command injection and remote code execution vulnerabilities in two NAS products that have reached end-of-vulnerability-support. Users are advised to install them for optimal protection. Three out of five vulnerabilities could allow an unauthorized attacker to run operating system commands and arbitrary code on affected installations. …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Oracle WebLogic Server to the Known Exploited Vulnerabilities (KEV) catalog. CVE-2017-3506 is an operating system (OS) command injection vulnerability which could be exploited to obtain unauthorized access as well as the full control. “Oracle WebLogic Server, a product within the …

Over 600,000 small office/home office (SOHO) routers were disabled in a cyber attack, cutting off users’ internet access. Security analysts at Lumen Technologies’ Black Lotus Labs discovered and reported on an attack in a recent blog post. There was a mysterious event in the U.S. that happened from October 25 …

NGINX team released important updates for their web server software and is advising users to upgrade as soon as possible. The updates fix four important vulnerabilities in the HTTP/3 implementation, especially affecting configurations using the “ngx_http_v3_module.” CVE-2024-32760: A vulnerability in NGINX Plus or NGINX OSS causes HTTP/3 QUIC module to …