InfoSecBulletin Cybersecurity for mankind
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to prevent exploitation.
New vulnerabilities, CVE-2023-34192 and CVE-2024-49035, affect popular platforms and pose serious risks to public and private sectors.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
CVE-2023-34192 is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. With a CVSS score of 9.0, it allows authenticated remote attackers to inject harmful scripts through the /h/autoSaveDraft function, which may enable them to execute arbitrary code and gain full control of affected systems.
The XSS vulnerability in Zimbra ZCS 8.8.15 poses a serious risk. Organizations should urgently apply Patch 40 to protect their systems, as delays may lead to data breaches. Users are strongly urged to update to Patch 40 immediately.
CVE-2024-49035 is a critical privilege escalation vulnerability in partner.microsoft.com, with a CVSS score of 8.7. It allows unauthenticated attackers to gain elevated privileges through improper access control.
Microsoft revealed this vulnerability last November, acknowledging researchers Gautam Peri, Apoorv Wadhwa, and an anonymous contributor for its discovery. However, the company has not shared details about its real-world exploitation.
Microsoft is releasing automatic fixes for the online version of Power Apps. Organizations using the Microsoft Partner Portal should ensure their systems are updated and adopt strong security measures to guard against potential attacks.
CISA requires FCEB agencies to apply necessary patches for both vulnerabilities by March 18, 2025.
CISA Flags Oracle Agile PLM Actively Exploited Security Flaw
