CISA Flags 6 Vulnerabilities – Apple, Apache, Adobe , D-Link, Joomla Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified six security vulnerabilities that are being actively exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

CVE-2023-27524 is a high-severity vulnerability in Apache Superset. It has a CVSS score of 8.9 and could allow remote code execution. The issue was resolved in version 2.1.

• Uncategorized

Cisco released security updates for two critical security flaws

By infosecbulletin / Thursday , September 5 2024

CISCO released security updates for two critical security flaws impacting its smart Licensing Utility that could allow unauthenticated, remote attackers...

Read More

• Hot Topic

OpenBAS: Cutting-edge breach and attack simulation platform

By infosecbulletin / Wednesday , September 4 2024

OpenBAS is a platform that helps organizations to plan, schedule, and conduct crisis exercises, adversary simulations, and breach simulations. OpenBAS...

Read More

• Vulnerabilities

Critical Security Flaws Patched in Zyxel Networking Devices

By infosecbulletin / Wednesday , September 4 2024

Zyxel has released software updates to fix a serious security issue in certain access point (AP) and security router versions....

Read More

• Vulnerabilities

CVE-2024-38811: CEV In VMware Fusion Unveiled

By infosecbulletin / Tuesday , September 3 2024

VMware released a security advisory for a major vulnerability in the VMware Fusion product. This vulnerability could be exploited by...

Read More

• Cyber Attack
• Vulnerabilities

CERT-IN Warns Vulnerabilities in Palo Alto Networks applications

By infosecbulletin / Tuesday , September 3 2024

Indian Computer Emergency Response Team (CERT-IN) issued advisories about multiple vulnerabilities in various Palo Alto Networks applications. Attackers could exploit...

Read More

• International

How Malaysia’s Data Centre Industry Poised for Growth

By infosecbulletin / Tuesday , September 3 2024

Malaysia is quickly becoming a leading choice for investing in data centers. It aims to generate RM3.6 billion (US$781 million)...

Read More

• Cyber Attack

RansomHub exfiltrated data over 210 victims: US alert

By infosecbulletin / Tuesday , September 3 2024

US authorities have issued a cybersecurity advisory about a ransomware group called RansomHub. The group is thought to have stolen data...

Read More

• Vulnerabilities

Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw

By infosecbulletin / Tuesday , September 3 2024

There is a new way to attack Atlassian Confluence using the vulnerability CVE-2023-22527. The Confluence Data Center and Server products...

Read More

• Cyber Attack

New Cicada ransomware targets VMware ESXi servers

By infosecbulletin / Tuesday , September 3 2024

The Cicada3301 ransomware is made in Rust and attacks Windows and Linux/ESXi hosts. Truesec researchers examined a version that targets...

Read More

• Uncategorized

Monday hits two UK bank apps causes outages

By infosecbulletin / Tuesday , September 3 2024

Lloyds Bank and Virgin Money's internet banking services were down on Monday, causing trouble for users to access and view...

Read More

In April 2023, Horizon3.ai’s Naveen Sunkavally revealed a problem with Apache Superset. The issue allows unauthorized attackers to remotely execute code, steal credentials, and compromise data.

It is currently unknown how the vulnerability is being exploited. CISA has also included five other flaws.

CVE-2023-38203 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-29300 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-41990 (CVSS score: 7.8) – Apple Multiple Products Code Execution Vulnerability

CVE-2016-20017 (CVSS score: 9.8) – D-Link DSL-2750B Devices Command Injection Vulnerability

CVE-2023-23752 (CVSS score: 5.3) – CVE-2023-41990, fixed in iOS 15.7.8 and iOS 16.3, was exploited by unknown actors in Operation Triangulation spyware attacks to execute code remotely via a specially crafted iMessage PDF attachment.

Federal agencies need to fix the mentioned bugs by January 29, 2024, to protect their networks from threats.