Experimental News Clipping Site

Tag: remote attackers

  • The Register: SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/02/14/sonicwall_firewalls_under_attack_patch/ Source: The Register Title: SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN Feedly Summary: Roses are red, violets are blue, CVE-2024-53704 is perfect for a ransomware crew Miscreants are actively abusing a high-severity authentication bypass bug in unpatched internet-facing SonicWall firewalls following the public release of…

  • The Register: Cisco patches two critical Identity Services Engine flaws

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/02/05/cisco_plugs_two_critical_ise_bugs/ Source: The Register Title: Cisco patches two critical Identity Services Engine flaws Feedly Summary: One gives root access, the other lets you steal info and reconfig nodes, in the right (or should that be wrong) circumstances Cisco has fixed two critical vulnerabilities in its Identity Services Engine (ISE) that could allow an…

  • Bulletins: Vulnerability Summary for the Week of January 27, 2025

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/bulletins/sb25-034 Source: Bulletins Title: Vulnerability Summary for the Week of January 27, 2025 Feedly Summary: High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info 0xPolygonZero–plonky2  Plonky2 is a SNARK implementation based on techniques from PLONK and FRI. Lookup tables, whose length is not divisible by 26 = floor(num_routed_wires / 3) always…

  • The Register: Don’t want your Kubernetes Windows nodes hijacked? Patch this hole now

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/24/kubernetes_windows_nodes_bug/ Source: The Register Title: Don’t want your Kubernetes Windows nodes hijacked? Patch this hole now Feedly Summary: SYSTEM-level command injection via API parameter *chef’s kiss* A now-fixed command-injection bug in Kubernetes can be exploited by a remote attacker to gain code execution with SYSTEM privileges on all Windows endpoints in a cluster,…