InfoSecBulletin Cybersecurity for mankind
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to prevent exploitation.
New vulnerabilities, CVE-2023-34192 and CVE-2024-49035, affect popular platforms and pose serious risks to public and private sectors.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CVE-2023-34192 is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. With a CVSS score of 9.0, it allows authenticated remote attackers to inject harmful scripts through the /h/autoSaveDraft function, which may enable them to execute arbitrary code and gain full control of affected systems.
The XSS vulnerability in Zimbra ZCS 8.8.15 poses a serious risk. Organizations should urgently apply Patch 40 to protect their systems, as delays may lead to data breaches. Users are strongly urged to update to Patch 40 immediately.
CVE-2024-49035 is a critical privilege escalation vulnerability in partner.microsoft.com, with a CVSS score of 8.7. It allows unauthenticated attackers to gain elevated privileges through improper access control.
Microsoft revealed this vulnerability last November, acknowledging researchers Gautam Peri, Apoorv Wadhwa, and an anonymous contributor for its discovery. However, the company has not shared details about its real-world exploitation.
Microsoft is releasing automatic fixes for the online version of Power Apps. Organizations using the Microsoft Partner Portal should ensure their systems are updated and adopt strong security measures to guard against potential attacks.
CISA requires FCEB agencies to apply necessary patches for both vulnerabilities by March 18, 2025.
CISA Flags Oracle Agile PLM Actively Exploited Security Flaw
