Vulnerabilities
Adobe patches critical code execution vulnerability in ColdFusion for which a proof-of-concept (PoC) blog exists.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Vulnerabilities
A critical vulnerability in the Cisco SD-WAN vManage software could allow unauthenticated attackers to retrieve information from vulnerable instances.
Vulnerabilities
Several instances of the Reddit alternative Lemmy were hacked in recent days by attackers who had exploited a zero-day vulnerability.
Vulnerabilities
Google researchers have discovered that a Zimbra zero-day vulnerability has been exploited in the wild, with users being advised to manually patch their installations.
Application Security
QuickBlox SDK and API vulnerabilities impact chat and video applications used by industries including telemedicine, smart IoT, and finance.
Vulnerabilities
The All-In-One Security (AIOS) WordPress plugin was found to be writing plaintext passwords to log files.
Vulnerabilities
Juniper Networks has patched multiple high-severity vulnerabilities in Junos OS, Junos OS Evolved, and Junos Space.
Vulnerabilities
Apple has re-released its Rapid Security Response updates for iOS and macOS after fixing a website access issue caused by the original patches.
Vulnerabilities
SonicWall patches four critical-severity vulnerabilities in its Global Management System (GMS) and Analytics products.
ICS/OT
Two Rockwell Automation product vulnerabilities have been used for a new exploit by an APT group that could use it to target critical infrastructure.
Network Security
Multiple hardcoded accounts on the Technicolor TG670 DSL gateway router can be used to completely take over the impacted devices.
Vulnerabilities
Bugcrowd’s Inside the Mind of the Hacker report shows the speed and efficiency of hackers adopting new technologies to assist their hunting
Vulnerabilities
Citrix has patched a critical-severity vulnerability in Secure Access client for Ubuntu that could lead to remote code execution (RCE).
Vulnerabilities
Fortinet patches a critical-severity vulnerability in FortiOS and FortiProxy that could lead to remote code execution.
Vulnerabilities
SAP on July 2023 Security Patch Day released 16 new security notes, including one addressing a critical vulnerability in ECC and S/4HANA (IS-OIL).
Cybercrime
Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.
Application Security
Software maker calls special attention to CVE-2023-29300, a deserialization of untrusted data bug with a CVSS severity score of 9.8/10.
Incident Response
Apple rolls out urgent iOS and iPadOS software updates and warned that zero-day exploitation has already been detected.
Application Security
VMware confirmed that exploit code for CVE-2023-20864 has been published, underscoring the urgency for enterprise network admins to apply available patches.
Vulnerabilities
PoC exploit has been published for a recently patched Ubiquiti EdgeRouter vulnerability leading to arbitrary code execution.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)