InfoSecBulletin Cybersecurity for mankind
CERT-In issued a security advisory for multiple vulnerabilities in the Zoom app that could let attackers access sensitive information, escalate privileges, or disrupt service.
Vulnerabilities exist in various Zoom products, including the Zoom Workplace App, Zoom Rooms Client, and Zoom Video SDK, across multiple operating systems: macOS, iOS, Windows, Linux, and Android.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Many Zoom applications are affected by the these vulnerabilities notably those before version 6.2.0. Affected products include:
CIRT in address the vulnerability as Improper Input Validation (CVE-2024-45422), Buffer Overflow Vulnerability (CVE-2024-45421), Symlink Following (CVE-2024-45418), Uncontrolled Resource Consumption (CVE-2024-45420), Improper Input Validation and Information Disclosure (CVE-2024-45419), Uncontrolled Resource Consumption in macOS Installers (CVE-2024-45417.
The vulnerabilities in these products arise from issues like improper input validation, buffer overflows, symlink following, and uncontrolled resource consumption. These flaws can result in serious consequences, including unauthorized system access, privilege escalation, and denial of service (DoS) attacks.
Zoom has recognized the issues and released updates on their website to fix them. This emphasizes the need for regular software updates to ensure cybersecurity.
Malware evades Microsoft Defender and 2FA, stealing $24K in crypto (video)
