#SecurityUpdates

About the security content of visionOS 2.2 – Apple Support

by

December 11, 2024 at 01:33PM Apple Vision Pro’s visionOS 2.2 has multiple vulnerabilities addressed through updates, including permissions issues, memory handling improvements, and enhanced network security. Notable CVEs include CVE-2024-54513, CVE-2024-54486, and CVE-2024-45490, which could lead to data exposure, unexpected app termination, or memory corruption. Update available on December 11, 2024. ### Meeting Takeaways: **Release … Read more

Google Open Sources Security Patch Validation Tool for Android

by

December 6, 2024 at 07:00AM Google has open-sourced Vanir, a patch validation tool for Android developers to detect missing security patches efficiently. With automated code scanning, Vanir improves security update processes for OEMs, streamlining vulnerability management. The tool, which supports C/C++ and Java, can also be adapted for other ecosystems beyond security validation. **Meeting Takeaways:** … Read more

PoC Exploit Published for Unpatched Mitel MiCollab Vulnerability

by

December 6, 2024 at 06:38AM WatchTowr warned of an unpatched vulnerability in the Mitel MiCollab platform, allowing attackers to access restricted resources. Over 16,000 instances are affected, with an arbitrary file read flaw requiring admin authentication to exploit. Mitel has released patches for related vulnerabilities and recommends users update to the latest version. **Meeting Takeaways:** … Read more

Exploit released for critical WhatsUp Gold RCE flaw, patch now

by

December 3, 2024 at 02:00PM A proof-of-concept exploit for a critical remote code execution vulnerability in Progress WhatsUp Gold has been released. It is essential to install the latest security updates immediately to mitigate potential risks. **Meeting Takeaways:** 1. **Critical Security Flaw:** A proof-of-concept exploit has been released for a critical-severity remote code execution vulnerability … Read more

Microsoft re-releases Exchange updates after fixing mail delivery

by

November 27, 2024 at 05:39PM Microsoft has re-released the November 2024 security updates for Exchange Server after resolving email delivery issues caused by the initial updates. Admins are advised to install the new version (Nov 2024 SUv2) for improved control and security. Automatic updates will be delayed until December to avoid disruption during Thanksgiving. ### … Read more

Oracle Patches Exploited Agile PLM Zero-Day

by

November 20, 2024 at 05:36AM Oracle announced patches for a critical information disclosure vulnerability (CVE-2024-21287) in Agile Product Lifecycle Management (PLM), which has been actively exploited. The flaw allows remote, unauthenticated attackers to access files under PLM application privileges. Users are urged to apply the updates promptly, as support for Agile PLM will end in … Read more

New Windows 11 recovery tool to let admins remotely fix unbootable devices

by

November 19, 2024 at 10:09AM Microsoft is introducing a “Quick Machine Recovery” feature for Windows to enable IT administrators to remotely recover unbootable systems via targeted fixes. This initiative follows a significant outage in July 2024 caused by a faulty update. Additionally, new security measures will prevent future risks from kernel-level drivers. ### Meeting Highlights: … Read more

Critical RCE bug in VMware vCenter Server now exploited in attacks

by

November 18, 2024 at 02:00PM Broadcom has warned that two VMware vCenter Server vulnerabilities, CVE-2024-38812 (a critical remote code execution flaw) and CVE-2024-38813 (a privilege escalation flaw), are being actively exploited. Customers are urged to apply new security updates to mitigate risks, as no workarounds are available for these vulnerabilities. ### Meeting Takeaways 1. **Active … Read more

Microsoft Pulls Exchange Patches Amid Mail Flow Issues

by

November 15, 2024 at 06:00PM Microsoft has retracted its November 2024 Exchange security updates due to email delivery issues reported by admins. The update disrupted mail flow rules and data loss protection for Exchange users. Microsoft advises affected customers to uninstall the updates while investigating a permanent fix, with the rollout paused until resolved. **Meeting … Read more

NIST Explains Why It Failed to Clear CVE Backlog

by

November 14, 2024 at 06:10AM NIST reported that all known exploited CVEs in the backlog have been addressed, but acknowledged that completely clearing the backlog by October was overly optimistic. **Meeting Takeaways:** 1. **Status of CVE Backlog**: NIST has addressed all known exploited CVEs but acknowledges that clearing the entire backlog by October was an … Read more