Ein lokaler Angreifer kann eine Schwachstelle in Juniper JUNOS ausnutzen, um beliebigen Programmcode auszuführen. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) Lesen Sie den originalen Artikel: [NEU] [mittel] Juniper JUNOS: Schwachstelle ermöglicht Codeausführung
[NEU] [hoch] Cisco IOS XR: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XR ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, erhöhte Rechte zu erlangen, beliebigen Code auszuführen und Daten zu manipulieren. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security…
Microsoft Finally Patches 2-Year-Old Windows Kernel Security Flaw
Microsoft has released a critical patch for a 2-year-old Windows kernel security vulnerability. This vulnerability, identified as CVE-2025-24983, allows attackers to exploit a weakness in the Windows Win32 Kernel Subsystem, leading to an elevation of privilege. The patch comes after…
North Korean Hackers’ Android Malware on Google Play Steals SMS, Call Logs & Screenshots
A sophisticated new Android malware campaign linked to North Korean hackers has been discovered, posing a significant security threat that managed to infiltrate Google’s official Play Store. The spyware, dubbed “KoSpy,” targets Korean and English-speaking users by disguising itself as…
Tenda AC7 Routers Vulnerability Let Attackers Gain Root Shell With Malicious Payload
A severe vulnerability in Tenda AC7 Routers running firmware version V15.03.06.44 allows malicious actors to execute arbitrary code and gain root shell access. The flaw originates from a stack overflow vulnerability in the router’s formSetFirewallCfg function. Attackers can use a…
Meta Warns of FreeType Vulnerability Exploited in Wild to Execute Arbitrary Code
A critical vulnerability in the widely used FreeType font rendering library has been discovered and is reportedly being exploited in the wild, posing a serious security threat to millions of devices across multiple platforms. Security researchers have identified the flaw,…
Blind Eagle Attacking Organizations With Weaponized .url Files To Extract User Hash
The cybersecurity landscape has witnessed a concerning development as the threat actor group known as Blind Eagle (also tracked as APT-C-36) has launched a sophisticated campaign targeting organizations primarily in South America with a novel attack vector. The group, known…
Beware of North Korean Hackers DocSwap Malware Disguised As Security Document Viewer
A sophisticated malware campaign targeting mobile users in South Korea has been uncovered, with clear links to North Korean threat actors. The malicious application, masquerading as a “Document Viewing Authentication App” (문서열람 인증 앱). This malicious app was identified through…
Future-Proofing Business Continuity: BCDR Trends and Challenges for 2025
As IT environments grow more complex, IT professionals are facing unprecedented pressure to secure business-critical data. With hybrid work the new standard and cloud adoption on the rise, data is increasingly distributed across different environments, providers and locations, expanding the…
Schadcode-Sicherheitslücken bedrohen FortiOS, FortiSandbox & Co.
Mehrere Produkte von Fortinet sind attackierbar. Sicherheitspatches schaffen Abhilfe. Dieser Artikel wurde indexiert von heise security News Lesen Sie den originalen Artikel: Schadcode-Sicherheitslücken bedrohen FortiOS, FortiSandbox & Co.
[NEU] [niedrig] Apache Camel: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Camel ausnutzen, um Dateien zu manipulieren. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) Lesen Sie den originalen Artikel: [NEU] [niedrig] Apache Camel: Schwachstelle ermöglicht Manipulation…
North Korean Hackers Use Google Play Malware to Steal SMS, Calls & Screenshots
Cybersecurity researchers at Lookout Threat Lab have uncovered a sophisticated Android surveillance tool dubbed “KoSpy,” which appears to be the work of North Korean state-sponsored hackers. This newly discovered spyware has been active since March 2022, with the most recent…
Hackers Exploiting JSPSpy To Manage Malicious Webshell Networks
Cybersecurity researchers have recently identified a cluster of JSPSpy web shell servers featuring an unexpected addition, Filebroser, a rebranded version of the open-source File Browser file management tool. This discovery sheds light on how attackers continue to leverage web shells…
Security Maturity Models: Leveraging Executive Risk Appetite for Your Secure Development Evolution
Organizations can align their processes with one of two global industry standards for self-assessment and security maturity—BSIMM and OWASP SAMM. The post Security Maturity Models: Leveraging Executive Risk Appetite for Your Secure Development Evolution appeared first on SecurityWeek. This article…
Suspected North Korea Group Targets Android Devices with Spyware
A North Korea-backed threat group, APT37, disguised KoSpy as utility apps in Google Play to infect Android devices, using the spyware for such activities as gathering sensitive information, tracking locations, capturing screenshots, recording keystrokes, and accessing files. The post Suspected…
Tech Complexity Puts UK Cybersecurity at Risk
Palo Alto Networks found that nearly two-thirds of UK organizations cited technology complexity as the most significant challenge towards building a sophisticated security posture This article has been indexed from www.infosecurity-magazine.com Read the original article: Tech Complexity Puts UK Cybersecurity…
Aerticket: Cyberangriff trifft Berliner Großhändler für Flugtickets
Nach einem Hackerangriff ist das Buchungssystem von Aerticket vorerst unbrauchbar. Eine schnelle Wiederherstellung ist wohl nicht zu erwarten. (Cybercrime, Cyberwar) Dieser Artikel wurde indexiert von Golem.de – Security Lesen Sie den originalen Artikel: Aerticket: Cyberangriff trifft Berliner Großhändler für Flugtickets
[NEU] [mittel] PaloAlto Networks PAN-OS: Mehrere Schwachstellen
Ein lokaler Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) Lesen Sie den originalen Artikel: [NEU] [mittel] PaloAlto…
[NEU] [hoch] PaloAlto Networks GlobalProtect: Mehrere Schwachstellen
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in PaloAlto Networks GlobalProtect ausnutzen, um beliebigen Code auszuführen und erhöhte Privilegien zu erlangen. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) Lesen Sie den originalen…
[NEU] [hoch] GitLab: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Informationen preiszugeben, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen. Dieser Artikel wurde indexiert von BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) Lesen Sie…
Mozilla Issues Urgent Firefox Update Warning to Prevent Add-on Failures
Mozilla has issued an urgent warning to all Firefox users, emphasizing the need to update their browsers before a critical root certificate expires on March 14, 2025. This certificate is used to verify signed content and add-ons across various Mozilla…
Meta warns of actively exploited flaw in FreeType library
Meta warned that a vulnerability, tracked as CVE-2025-27363, impacting the FreeType library may have been exploited in the wild. Meta warned that an out-of-bounds write flaw, tracked as CVE-2025-27363 (CVSS score of 8.1), in the FreeType library may have been actively exploited in attacks.…
Google Uncovers China-Linked Espionage Campaign Targeting Juniper Routers
Google’s Threat Analysis Group (TAG) and Mandiant have uncovered a sophisticated espionage campaign linked to China-nexus threat actors, targeting vulnerable Juniper routers used in enterprise and government networks worldwide. This discovery highlights the ongoing risks posed by state-sponsored attacks against…
New Federal Alert Warns U.S. Businesses of Medusa Ransomware Surge
In a joint advisory, US federal agencies have issued a cybersecurity warning about a sharp increase in attacks by Medusa ransomware, urging business leaders and IT teams to act immediately to protect their organizations. The Federal Bureau of Investigation (FBI),…