Microsoft’s July Patch Tuesday fix package is causing chaos for sysadmins, with at least two bugs actively being exploited. The updates address a total of 139 Microsoft CVEs. One of the vulnerabilities, CVE-2024-38080, is a Windows Hyper-V elevation of privilege flaw with a CVSS rating of 7.8, deemed “important” by Microsoft. Another bug, CVE-2024-38112, affects … Read more
VMware has recently addressed critical vulnerabilities in its ESXi virtualization platform that could allow attackers to escape from the sandboxed environment. These vulnerabilities were highlighted during Safety Week, a global initiative focused on raising awareness about the importance of cybersecurity. VMware acted promptly to release patches for these vulnerabilities, ensuring that users can continue to … Read more
Last week, multiple critical vulnerabilities were discovered across various platforms, impacting network infrastructure, software libraries, IoT devices, and CPUs. OpenSSH fixed a signal handler race issue, Juniper Networks addressed an authentication bypass problem, and CocoaPods resolved supply chain attack vulnerabilities. Cisco found a command injection issue, Intel CPUs were vulnerable to a side-channel attack, and … Read more
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the Cisco NX-OS command injection bug, known as CVE-2024-20399, to its Catalog of Known Exploited Vulnerabilities (KEV). The vulnerability, with a CVSS score of 6.0, allows authenticated local attackers to execute arbitrary commands on vulnerable switches as root. The issue was first observed by cybersecurity … Read more
In their weekly report from June 26 to July 2, Cyble Research and Intelligence Laboratories (CRIL) analyzed 29 vulnerabilities, including critical and high-severity flaws in Juniper Networks, OpenSSH, and GitLab products. They also highlighted a medium severity vulnerability in Cisco Nexus switches that is being actively exploited, as well as exploits for sale on the … Read more
Cisco has recently released security updates to address a critical vulnerability (CVE-2024-20399) in its Cisco NX-OS software. This vulnerability is actively being exploited and could allow an authenticated local attacker with administrator credentials to run arbitrary commands with root privileges on the underlying operating system. The affected Cisco switches include MDS 9000 Series Multilayer Switches, … Read more
Oracle WebLogic servers that are vulnerable to old flaws, specifically identified as CVE-2017-3506, CVE-2017-10271, and CVE-2023-21839, have recently been targeted by the 8220 Gang threat operation, also known as Water Sigbin. According to reports from Hacker News, the attackers have successfully infiltrated these servers and distributed a PowerShell script to launch a WireGuard VPN application-spoofing … Read more
Cybersecurity researchers have uncovered a complex attack campaign orchestrated by the threat actor Water Sigbin (also known as 8220 Gang), targeting vulnerabilities in Oracle WebLogic Server, specifically CVE-2017-3506 and CVE-2023-21839. The attackers employed these vulnerabilities to plant the XMRig cryptocurrency miner on compromised systems. To avoid detection, Water Sigbin utilized advanced tactics such as code … Read more
Citrix has issued warnings about two zero-day vulnerabilities affecting its customer-managed Netscaler Application Delivery Controller and Netscaler Gateway appliances, with reports of active exploitation in a limited number of cases. The vulnerabilities, tracked as CVE-2023-6548 and CVE-2023-6549, could result in remote code execution and denial of service attacks, respectively. These vulnerabilities come more than three … Read more
Citrix has released patches for two zero-day vulnerabilities that were actively being exploited in their NetScaler ADC and Gateway products. This news comes as a relief to many organizations, especially those in the healthcare industry who are subject to HIPAA regulations. The vulnerabilities could have allowed attackers to gain unauthorized access to sensitive information, potentially … Read more