InfoSecBulletin Cybersecurity for mankind
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to prevent exploitation.
New vulnerabilities, CVE-2023-34192 and CVE-2024-49035, affect popular platforms and pose serious risks to public and private sectors.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
CVE-2023-34192 is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. With a CVSS score of 9.0, it allows authenticated remote attackers to inject harmful scripts through the /h/autoSaveDraft function, which may enable them to execute arbitrary code and gain full control of affected systems.
The XSS vulnerability in Zimbra ZCS 8.8.15 poses a serious risk. Organizations should urgently apply Patch 40 to protect their systems, as delays may lead to data breaches. Users are strongly urged to update to Patch 40 immediately.
CVE-2024-49035 is a critical privilege escalation vulnerability in partner.microsoft.com, with a CVSS score of 8.7. It allows unauthenticated attackers to gain elevated privileges through improper access control.
Microsoft revealed this vulnerability last November, acknowledging researchers Gautam Peri, Apoorv Wadhwa, and an anonymous contributor for its discovery. However, the company has not shared details about its real-world exploitation.
Microsoft is releasing automatic fixes for the online version of Power Apps. Organizations using the Microsoft Partner Portal should ensure their systems are updated and adopt strong security measures to guard against potential attacks.
CISA requires FCEB agencies to apply necessary patches for both vulnerabilities by March 18, 2025.
CISA Flags Oracle Agile PLM Actively Exploited Security Flaw
