Microsoft has detected Storm-0501 using Cobalt Strike for lateral movement across networks and deploying Embargo ransomware on victim organizations in hybrid cloud setups. This article has been indexed from Cyware News – Latest Cyber News Read the original article: Storm-0501…
Tag: Cyware News – Latest Cyber News
Critical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593
Two critical vulnerabilities, CVE-2024-6592 and CVE-2024-6593, have been found in WatchGuard’s Authentication Gateway and Single Sign-On Client software by cybersecurity firm RedTeam Pentesting GmbH. This article has been indexed from Cyware News – Latest Cyber News Read the original article:…
DCRat Targets Users with HTML Smuggling
A new HTML smuggling campaign is targeting Russian-speaking users, distributing DCRat malware. This marks the first time the malware has been deployed using this method, unlike common delivery methods like compromised sites or phishing emails. This article has been indexed…
Unpatched SQLi Flaw in TI WooCommerce Wishlist Threatens 100,000+ Sites
A critical security flaw, CVE-2024-43917, with a CVSS score of 9. 3, has been found in the popular WordPress plugin TI WooCommerce Wishlist, putting over 100,000 sites at risk of SQL injection attacks. This article has been indexed from Cyware…
Critical RCE Vulnerability Found in OpenPLC
The most severe issue is a stack-based buffer overflow vulnerability (CVE-2024-34026) that allows an attacker to execute remote code. Users are advised to update to the latest version of OpenPLC to protect against these security risks. This article has been…
BBTok Targeting Brazil Using the AppDomain Manager Injection Technique
The Brazilian-targeted threat BBTok has a complex infection chain that starts with an email containing an ISO image. The malware compiles C# code directly on the infected machine and uses the AppDomain Manager Injection technique. This article has been indexed…
HPE Patches Three Critical Security Holes in Aruba PAPI
HPE has released patches for three critical security vulnerabilities in Aruba’s networking access points, which could allow attackers to run code on the systems by sending specially crafted packets to UDP port 8211. This article has been indexed from Cyware…
China-linked APT group Salt Typhoon compromised some US ISPs
Experts are investigating whether the hackers gained access to Cisco Systems routers, a key component of ISP infrastructures, but Cisco has not found any indication of router involvement. This article has been indexed from Cyware News – Latest Cyber News…
Kia Dealer Portal Flaw Could Let Attackers Hack Millions of Cars
The vulnerabilities could be exploited to remotely control Kia vehicles equipped with remote hardware in under 30 seconds, exposing the sensitive personal information of car owners. This article has been indexed from Cyware News – Latest Cyber News Read the…
Critical Vulnerabilities Discovered in Automated Tank Gauge Systems From Multiple Vendors
Security researchers at Bitsight discovered critical vulnerabilities in Automated Tank Gauge (ATG) systems, including Maglink LX, Maglink LX4, OPW SiteSentinel, Proteus OEL8000, Alisonic Sibylla, and Franklin TS-550. This article has been indexed from Cyware News – Latest Cyber News Read…
Critical Flaw in HashiCorp Vault Enables Unrestricted SSH Access, Threatens System Security
HashiCorp has released updated versions (1.17.6, 1.16.10, 1.15.15) to fix the flaw, along with a new configuration option to enhance security. Users are advised to upgrade or adjust their configurations to protect against exploitation. This article has been indexed from…
CISA Warns of Hackers Targeting Industrial Systems Using “Unsophisticated Methods”
The CISA has issued a warning about hackers using basic techniques to target industrial systems, particularly OT and ICS devices in critical infrastructure, water, and wastewater systems. This article has been indexed from Cyware News – Latest Cyber News Read…
Critical WhatsUp Gold Vulnerabilities Demand Immediate Action
The six vulnerabilities, with high severity scores, could lead to unauthorized access and control over network infrastructure. Progress Software advises all WhatsUp Gold users to upgrade to version 24.0.1 to mitigate these vulnerabilities. This article has been indexed from Cyware…
Phishing-as-a-Service Platform Sniper Dz Used to Create 140,000 Phishing Sites in One Year
Cybersecurity researchers at Palo Alto Networks’ Unit 42 have discovered a prolific Phishing-as-a-Service platform called Sniper Dz, responsible for creating over 140,000 phishing websites in just one year. This article has been indexed from Cyware News – Latest Cyber News…
Critical Flaws Discovered in Jupiter X Core WordPress Plugin Affecting Over 90,000 Sites
Security researchers have found critical flaws in the Jupiter X Core WordPress plugin, affecting over 90,000 websites. The vulnerabilities could allow attackers to take control of websites or hijack user accounts, including admin accounts. This article has been indexed from…
VLC Media Player Update Needed: CVE-2024-46461 Discovered
VLC Media Player users are urged to update their software due to the critical CVE-2024-46461 vulnerability, which could crash the program or lead to code execution by malicious actors. This article has been indexed from Cyware News – Latest Cyber…
Critical CUPS Vulnerabilities Expose Linux and Other Systems to Remote Attacks
Multiple critical vulnerabilities in CUPS (Common Unix Printing System) have been uncovered, affecting Linux systems, BSDs, Oracle Solaris, and Google Chrome OS. These flaws can enable attackers to execute arbitrary commands through IPP URLs. This article has been indexed from…
Critical Vulnerabilities Found in NVIDIA Container Toolkit
Nvidia Container Toolkit has critical vulnerabilities (CVE-2024-0132 and CVE-2024-0133) up to v1.16.1, allowing attackers to access the host file system, execute code, escalate privileges, and disrupt services. This article has been indexed from Cyware News – Latest Cyber News Read…
Pure Storage Reveals CVSS 10 Vulnerabilities, Putting FlashArray, FlashBlade Systems at Risk
The identified flaws include a local configuration account vulnerability, remote access via privileged accounts, remote account creation, remote command execution, and SNMP configuration exploitation. This article has been indexed from Cyware News – Latest Cyber News Read the original article:…
Critical SQL Injection Vulnerability Discovered in ‘The Events Calendar’ WordPress Plugin
A critical SQL injection vulnerability has been discovered in The Events Calendar WordPress plugin (CVE-2024-8275), affecting all versions up to 6. 6. 4. The vulnerability has a CVSS score of 9. 8, indicating a high level of severity. This article…