December 3, 2024 at 02:00PM A proof-of-concept exploit for a critical remote code execution vulnerability in Progress WhatsUp Gold has been released. It is essential to install the latest security updates immediately to mitigate potential risks. **Meeting Takeaways:** 1. **Critical Security Flaw:** A proof-of-concept exploit has been released for a critical-severity remote code execution vulnerability … Read more
November 27, 2024 at 04:04PM A critical authentication bypass flaw (CVE-2024-11680) in ProjectSend allows attackers to exploit vulnerable versions to upload webshells and gain remote access. Despite a fix released on May 16, 2023, 99% of users remain vulnerable. Active exploitation has surged since September 2024, necessitating urgent updates to version r1750. ### Meeting Takeaways … Read more
November 7, 2024 at 07:02AM Cisco has issued an alert about a serious vulnerability (CVE-2024-20418) affecting its Ultra-Reliable Wireless Backhaul systems. The flaw allows unauthorized remote access to admin-level control and potential exploitation. Affected models include Catalyst IW9165D/E and IW9167E. Immediate patching is required, with a CVSS score of 10.0. **Meeting Takeaways on Cisco Critical … Read more
October 24, 2024 at 02:26PM Cisco has patched a medium-severity security flaw (CVE-2024-20481) in its ASA and FTD software, exploited through brute-force attacks leading to resource exhaustion in devices with remote access VPN enabled. The vulnerability is included in CISA’s Known Exploited Vulnerabilities Catalog, and Cisco urges users to apply updates promptly. ### Meeting Takeaways: … Read more
October 1, 2024 at 05:47PM Cyber attackers are actively exploiting a severe remote code execution vulnerability (CVE-2024-45519) in Zimbra’s SMTP server, allowing them to take control of vulnerable systems. Proofpoint researchers observed attacks since Sept. 28, with attackers sending spoofed emails containing base64-encoded malicious code. Zimbra issued updates, but administrators need to apply them promptly … Read more
September 27, 2024 at 08:02AM Progress Software recently identified and warned customers about six vulnerabilities in WhatsUp Gold, urging them to upgrade to version 24.0.1 to address these issues. The vulnerabilities, including SQL injection and remote code execution flaws, were reported by various security researchers and have been exploited by attackers. Progress has released patches … Read more
September 16, 2024 at 03:12PM A critical remote code execution (RCE) vulnerability, CVE-2024-29847, in Ivanti Endpoint Manager was exploited and publicly released by security researcher Sina Kheirkhah. The flaw allows a remote attacker to execute arbitrary operations and should be patched immediately with the security update released in September 2024. Additionally, other Ivanti vulnerabilities are … Read more
September 5, 2024 at 02:22PM Cisco’s Smart Licensing Utility has critical vulnerabilities, allowing remote attackers to access sensitive data and administer services without authentication. The flaws, rated 9.8/10 in severity, lack workarounds and are fixed through software updates. Customers are urged to patch immediately, ensuring legitimate software access. No known malicious activity has been reported. … Read more
August 28, 2024 at 10:47AM Hitachi Energy advises immediate upgrade to the latest version of MicroSCADA X SYS600 to address multiple critical and high-severity vulnerabilities in the product. The vulnerabilities pose confidentiality, integrity, and availability risks, impacting over 10,000 substations and various industries. Hitachi Energy is not aware of any current exploitation, but urges prompt … Read more
August 21, 2024 at 10:35AM Jenkins, a widely used automation server, has been plagued by a critical CVE-2024-23897 vulnerability for seven months, with active exploitation ongoing. The vulnerability, if exploited, can lead to unauthorized file access, cryptographic key exposure, and code execution. Despite a security fix, many users failed to patch their systems, resulting in … Read more