InfoSecBulletin Cybersecurity for mankind
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to prevent exploitation.
New vulnerabilities, CVE-2023-34192 and CVE-2024-49035, affect popular platforms and pose serious risks to public and private sectors.
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
CVE-2023-34192 is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. With a CVSS score of 9.0, it allows authenticated remote attackers to inject harmful scripts through the /h/autoSaveDraft function, which may enable them to execute arbitrary code and gain full control of affected systems.
The XSS vulnerability in Zimbra ZCS 8.8.15 poses a serious risk. Organizations should urgently apply Patch 40 to protect their systems, as delays may lead to data breaches. Users are strongly urged to update to Patch 40 immediately.
CVE-2024-49035 is a critical privilege escalation vulnerability in partner.microsoft.com, with a CVSS score of 8.7. It allows unauthenticated attackers to gain elevated privileges through improper access control.
Microsoft revealed this vulnerability last November, acknowledging researchers Gautam Peri, Apoorv Wadhwa, and an anonymous contributor for its discovery. However, the company has not shared details about its real-world exploitation.
Microsoft is releasing automatic fixes for the online version of Power Apps. Organizations using the Microsoft Partner Portal should ensure their systems are updated and adopt strong security measures to guard against potential attacks.
CISA requires FCEB agencies to apply necessary patches for both vulnerabilities by March 18, 2025.
CISA Flags Oracle Agile PLM Actively Exploited Security Flaw
