September, 2024

• 17 September

  Petroleum and Fuel Industry
  FleetPanda exposes Nearly One Million Documents

  

  Cybersecurity researcher Jeremiah Fowler found a non-password-protected database with 780,000 records from FleetPanda, a tech provider for dispatch management. The database included invoices, driver applications, and images of licenses and background checks containing personal identifiable information (PII). A non-password-protected database held 780,191 documents, totaling 193 GB. The exposed files included …

  Read More »
• 17 September

  DESCO faces cyber attack: Customers Data Breach

  

  A recent dark web scan revealed that customer data from Dhaka Electric Supply Company Limited (DESCO) has been exposed. The breach affects 110,856 users and includes sensitive information like Customer Number, Name, Email, Address, and Mobile Number. The exposure of this data on the dark web poses several risks like: …

  Read More »
• 16 September

  Alert! Google Fixes GCP Composer Flaw

  

  Tenable Research found and fixed a remote code execution (RCE) vulnerability, called CloudImposer, in Google Cloud Platform (GCP). This flaw could have let attackers hijack a pre-installed software dependency in Google Cloud Composer. Additionally, Tenable identified concerning guidance in GCP documentation that customers should note. The Hacker News reported, quoted …

  Read More »
• 15 September

  CTF in Bangladesh: Unveiling Challenges, Opportunities and remedies

  

  In this article, we won’t dive too deep into the technical aspects of Capture The Flag (CTF) competitions. Instead, we will skim the surface of this wonderful side of the cyber world and highlight the amazing community that Bangladesh has been building over the years. We will get to know …

  Read More »
• 15 September

  Bitdefender blog post
  Medusa target Fortinet flaw (CVE-2023-48788) for Ransomware Attacks

  

  A recent Bitdefender report reveals that Medusa is still actively attacking and has created a notable presence on both the dark web and surface web, making it a ransomware group to monitor. Medusa stands out from other ransomware groups by maintaining a name-and-shame blog on the surface web, where it …

  Read More »
• 14 September

  Ivanti alerts ongoing exploitation of recently patched CAV

  

  Ivanti warned that a recently fixed security flaw in its Cloud Service Appliance (CSA) is being actively exploited. CVE-2024-8190 is a high-severity vulnerability (CVSS score: 7.2) that can enable remote code execution in specific situations. “An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and …

  Read More »
• 14 September

  CISA unveils 25 new advisories for Industrial Control Systems

  

  CISA issued 25 ICS advisories on September 12, 2024, detailing current security issues, vulnerabilities, and exploits in Industrial Control Systems. ICSA-24-256-01 Siemens SINEMA Remote Connect Server ICSA-24-256-02 Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D ICSA-24-256-03 Siemens User Management Component (UMC) ICSA-24-256-04 Siemens SINUMERIK Systems ICSA-24-256-05 Siemens Mendix Runtime ICSA-24-256-06 …

  Read More »
• 13 September

  Intel Issues Alert on 20+ Vulnerabilities, Urges Firmware Updates

  

  Intel announced over 20 vulnerabilities in its processors and products in security advisories released on Tuesday. The chip giant has released four new advisories, including one that addresses 11 vulnerabilities in UEFI firmware for various processors, such as Atom, Xeon, Pentium, Celeron, and Core series. Over half of the security …

  Read More »
• 13 September

  Urgent: GitLab Patches flaws allowing unapproved pipeline Job Execution

  

  GitLab released security updates on Wednesday to fix 17 vulnerabilities, including a critical issue that lets attackers run pipeline jobs as any user. CVE-2024-6678 is a critical vulnerability with a CVSS score of 9.9 out of 10.0 “An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior …

  Read More »
• 13 September

  Fortinet admits data breach after hacker claims to steal 440GB

  

  Fortinet confirmed a data breach after a threat actor claimed to have stolen 440GB of files from its Microsoft SharePoint server. Fortinet told two international media that, “An individual gained unauthorized access to a limited number of files stored on Fortinet’s instance of a third-party cloud-based shared file drive, which …

  Read More »