CISA Flags 6 Vulnerabilities – Apple, Apache, Adobe , D-Link, Joomla Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified six security vulnerabilities that are being actively exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

CVE-2023-27524 is a high-severity vulnerability in Apache Superset. It has a CVSS score of 8.9 and could allow remote code execution. The issue was resolved in version 2.1.

• Alert
• Vulnerabilities

Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS

By infosecbulletin / Monday , January 20 2025

Security researchers have found several vulnerabilities in Azure DevOps that could enable attackers to inject CRLF queries and carry out...

Read More

• Uncategorized

Intel holds 22 employees from one Bangladeshi University

By infosecbulletin / Monday , January 20 2025

Intel Corporation is a leading semiconductor chip manufacturer, employing at least 22 graduates from the Department of Applied Chemistry and...

Read More

• Uncategorized

VPN Surge 1500% in USA after TikTok Shut Down

By infosecbulletin / Sunday , January 19 2025

vpnMentor’s Research Team is monitoring the potential TikTok ban in the U.S., driven by national security and data privacy issues....

Read More

• International

MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology

By infosecbulletin / Saturday , January 18 2025

MITRE launched D3FENDTM 1.0, a cybersecurity framework that provides a vocabulary and understanding of the cyber domain. D3FEND 1.0, funded...

Read More

• Alert
• Vulnerabilities

AWS Patches Multiple Vulns in WorkSpaces, AppStream 2.0

By infosecbulletin / Friday , January 17 2025

Amazon Web Services (AWS) has recently fixed two major security vulnerabilities in its cloud services: Amazon WorkSpaces, Amazon AppStream 2.0,...

Read More

• International

Malware Trends Review 2024: Ever Recorded Cyber Threats

By infosecbulletin / Friday , January 17 2025

Last year saw a significant rise in cyber threats, with malware becoming more advanced and attack strategies more sophisticated. A...

Read More

• Alert
• Vulnerabilities

Botnet Exploits 13,000 MikroTik Devices Abusing Misconfigured DNS

By infosecbulletin / Thursday , January 16 2025

A recent Infoblox Threat Intel report reveals a sophisticated botnet that exploits DNS misconfigurations to spread malware widely. This botnet,...

Read More

• Alert
• Vulnerabilities

CVE-2024-9042
Code Execution Vulnerability Found in Kubernetes Windows Nodes

By infosecbulletin / Thursday , January 16 2025

A new security flaw traced, CVE-2024-9042, poses a serious risk to Kubernetes clusters with Windows worker nodes. It has a...

Read More

• Data Breach
• Vulnerabilities

Hacker leaked 15k config files and VPN passwords of FortiGate firewall device

By infosecbulletin / Thursday , January 16 2025

The hacking group "Belsen Group" has posted over 15,000 unique FortiGate firewall configurations online. The data dump, reportedly obtained by exploiting...

Read More

• Event

Registration open for 1st Agile Cyber Drill 2025

By infosecbulletin / Thursday , January 16 2025

Registration open for "1st Agile Cyber Drill-2025" scheduled for February 26, 2025 online with an awards ceremony for 9 March...

Read More

In April 2023, Horizon3.ai’s Naveen Sunkavally revealed a problem with Apache Superset. The issue allows unauthorized attackers to remotely execute code, steal credentials, and compromise data.

It is currently unknown how the vulnerability is being exploited. CISA has also included five other flaws.

CVE-2023-38203 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-29300 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-41990 (CVSS score: 7.8) – Apple Multiple Products Code Execution Vulnerability

CVE-2016-20017 (CVSS score: 9.8) – D-Link DSL-2750B Devices Command Injection Vulnerability

CVE-2023-23752 (CVSS score: 5.3) – CVE-2023-41990, fixed in iOS 15.7.8 and iOS 16.3, was exploited by unknown actors in Operation Triangulation spyware attacks to execute code remotely via a specially crafted iMessage PDF attachment.

Federal agencies need to fix the mentioned bugs by January 29, 2024, to protect their networks from threats.