Progress, the company behind MOVEit Transfer, has issued a critical security alert addressing a newly discovered vulnerability in its MOVEit Transfer product. The flaw, CVE-2024-6576, has been classified as a high-severity issue, with a CVSS score of 7.3, indicating a significant user risk. CVE-2024-6576: Improper Authentication Leading to Privilege Escalation The vulnerability found in the […]
The post Progress Patched New MOVEit File Transfer Flaw that Allows Privilege Escalation appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
Fortanix today extended the reach of its ability to discover encryption keys to on-premises IT environments to enable organizations to more comprehensively manage risks.
The post Fortanix Extends Encyption Key Discovery to On-Premises IT Platforms appeared first on Security Boulevard.
Discover, a new feature available to all DataDome customers, enables organizations to identify blind spots and shrink attack surfaces against malicious bots and fraudsters.
The post Uncover Your Attack Surface with Discover from DataDome appeared first on Security Boulevard.
For IDTR solutions, addressing compromised credentials head-on is crucial to protecting end users' environments.
The post Enzoic Dark Web Data Integration with IDTR Solutions appeared first on Security Boulevard.
Researchers uncovered Cuckoo Spear, a new threat actor associated with the APT10 group, demonstrating persistent stealthy operations within victim networks for two to three years. The advanced persistent threat (APT) utilizes novel techniques and tools to conduct cyber espionage, emphasizing the critical need for robust security protocols, continuous threat monitoring, and collaborative intelligence sharing among […]
The post Cuckoo Spear Attacking Windows Users With Highly Sophisticated Malware appeared first on Cyber Security News.
The popular audiobook and podcast platform uBook has been affected by a data breach that exposed the personal information of 710,000 users. According to a tweet by ThreatMon, the breach, which occurred in July 2024, was announced by a member of a dark web forum, raising serious concerns about user privacy and data security. Details […]
The post ubook Suffered Data Breach, 710,000 Users’ Data Exposed appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Update 9:00 a.m., EDT, July 31, 2024:
DigiCert has provided updated information and revocation timelines which can be found by visiting: https://status.digicert.com/
CISA encourages customers to contact DigiCert if unable to reissue/rekey certificates by the updated revocation deadline: 3:30 p.m., EDT, July 31, 2024.
Initial Alert (7:00 p.m., EDT, July 30, 2024):
DigiCert, a certificate authority (CA) organization, is revoking a subset of transport layer security (TLS) certificates due to a non-compliance issue with domain control verification (DCV). Revocation of these certificates may cause temporary disruptions to websites, services, and applications relying on these certificates for secure communication. DigiCert has notified affected customers and provided instructions on how to replace non-compliant certificates.
CISA urges DigiCert customers to check their DigiCert account to view any non-compliant certificates and reissue/rekey certificates. See DigiCert’s Revocation Incident Notice for customer instructions and more information.
Apple released security updates to address vulnerabilities in Safari, iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.
CISA encourages users and administrators to review the following advisories and apply necessary updates: