Aggregator

Hotjar и Business Insider – не единственные жертвы багов в системе аутентификации.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2024-37085 VMware ESXi Authentication Bypass Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Update 9:00 a.m., EDT, July 31, 2024: 

DigiCert has provided updated information and revocation timelines which can be found by visiting: https://status.digicert.com/

CISA encourages customers to contact DigiCert if unable to reissue/rekey certificates by the updated revocation deadline: 3:30 p.m., EDT, July 31, 2024.

Initial Alert (7:00 p.m., EDT, July 30, 2024):

DigiCert, a certificate authority (CA) organization, is revoking a subset of transport layer security (TLS) certificates due to a non-compliance issue with domain control verification (DCV). Revocation of these certificates may cause temporary disruptions to websites, services, and applications relying on these certificates for secure communication. DigiCert has notified affected customers and provided instructions on how to replace non-compliant certificates.

CISA urges DigiCert customers to check their DigiCert account to view any non-compliant certificates and reissue/rekey certificates. See DigiCert’s Revocation Incident Notice for customer instructions and more information.
 

Apple released security updates to address vulnerabilities in Safari, iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. 

CISA encourages users and administrators to review the following advisories and apply necessary updates: 

• Safari 17.6
• iOS 17.6 and iPadOS 17.6
• iOS 16.7.9 and iPadOS 16.7.9
• macOS Sonoma 14.6
• macOS Ventura 13.6.8
• macOS Monterey 12.7.6
• watchOS 10.6
• tvOS 17.6
• visionOS 1.3

The Medusa Ransomware Group experienced significant operational security (OPSEC) failure, which was primarily due to the group’s use of Rclone, a widely utilized tool for data exfiltration, to store stolen data in the cloud storage service put.io.  The key issue arose from a misconfigured Rclone configuration file, which contained access tokens and other credentials, inadvertently […]

The post Researchers Hacked into Medusa Ransomware Group’s Cloud Storage appeared first on Cyber Security News.

Cybercriminals have launched a smishing campaign targeting iPhone users in India, impersonating India Post. Malicious iMessages falsely claim a package awaits at an India Post warehouse, enticing victims to click on fraudulent links.  It leverages the widespread trust in India Post and the popularity of iPhones to deceive users into compromising their devices and potentially […]

The post iPhone Users Beware! Fake Postal Messages Stealing Your Login Credentials appeared first on Cyber Security News.

Hackers use phishing emails to mislead recipients into providing personal data like usernames, passwords, credit card numbers, or social security numbers. This method exploits human emotions and trust, allowing a threat actor to compromise an account, steal an identity, or disseminate malware with little technical skill. Guardio Labs recently discovered “EchoSpoofing” which is a serious […]

The post Proofpoint’s Email Protection Let Attackers Send Millions Of Phishing Emails appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

Hackers prefer ransomware attacks primarily because they offer the highest chance of financial gain. By locking victims’ information systems and asking for payment to release them, ransomware attacks lock victims’ information systems and demand payment to unlock them. Considering such a high level of risk, victims are pushed to make ransom payments as fast as […]

The post Hackers Exploiting ESXi Hypervisor Auth Bypass Flaw For Ransomware Attacks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

复盘历史上最大的 IT 故障

 A threat actor has taken to social media to claim responsibility for hacking into a Microsoft employee’s device. The announcement was made via a Telegram post, accompanied by a video purportedly showing the breach’s aftermath, as per a tweet by ThreatMon, a Cybersecurity Intelligence Platform. Details of the Alleged Breach The threat actor alleges that […]

The post Threat Actor Allegedly Claiming Hack of Microsoft Employee’s Device appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

A serious flaw in OpenSSH servers, dubbed “regreSSHion,” affects macOS systems and could allow a remote attacker to execute arbitrary code. A few weeks ago, Qualys’ threat research unit discovered this vulnerability, which has been identified as regreSSHion and tracked as CVE-2024-6387.  It was found that on glibc-based Linux systems, the vulnerability—a signal handler race […]

The post Critical OpenSSH “regreSSHion” Vulnerability Impacted macOS  Systems, Patch Now appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

The SocGholish downloader has been in operation since 2017 and it is still evolving. This malware, which poses as a browser update, is favored by multiple threat groups such as the Russian-operated Evil Corp (Manatee Tempest) and the Initial Access Broker TA569 (Mustard Tempest). In recent times, it is seen that the malware now specifically […]

The post SocGholish Malware Attacking Windows Users Using Fake Browser Update appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability was found in SiteOrigin Widgets Bundle up to 1.62.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Image Grid Widget. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-5901. The attack can be launched remotely. There is no exploit available.

As more people work remotely, IT departments must manage devices distributed over different cities and countries relying on VPNs and remote monitoring and management (RMM) tools for system administration.  However, like any new technology, RMM tools can also be used maliciously. Threat actors can establish connections to a victim's device and run commands, exfiltrate data, and stay

A vulnerability was found in SiberianCMS 5.0.8. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. This vulnerability is traded as CVE-2024-41702. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Priority PRI WEB Portal Add-On for ERP on Prem and classified as problematic. This issue affects some unknown processing. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2024-41696. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Cybonet PineApp Mail Relay and classified as problematic. This vulnerability affects unknown code. The manipulation leads to information disclosure. This vulnerability was named CVE-2024-41694. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in AccuPOS. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-41701. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Неожиданные источники данных для ИИ охватывают контент от YouTube до математических форумов.