Tag: vulnerability
-
Alerts: CISA Adds Three Known Exploited Vulnerabilities to Catalog
Source URL: https://www.cisa.gov/news-events/alerts/2025/03/19/cisa-adds-three-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Three Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection Vulnerability CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability These…
-
The Register: IBM scores perfect 10 … vulnerability in mission-critical OS AIX
Source URL: https://www.theregister.com/2025/03/19/ibm_aix_critical_vulnerabilities/ Source: The Register Title: IBM scores perfect 10 … vulnerability in mission-critical OS AIX Feedly Summary: Big Blue’s workstation workhorse patches hole in network installation manager that could let the bad guys in IBM “strongly recommends" customers running its Advanced Interactive eXecutive (AIX) operating system apply patches after disclosing two critical vulnerabilities,…
-
Hacker News: CVE-2024-9956 – PassKey Account Takeover in All Mobile Browsers
Source URL: https://mastersplinter.work/research/passkey/ Source: Hacker News Title: CVE-2024-9956 – PassKey Account Takeover in All Mobile Browsers Feedly Summary: Comments AI Summary and Description: Yes Summary: The provided text discusses a significant vulnerability found in major mobile browsers that enables an attacker within Bluetooth range to exploit FIDO URIs, undermining the security assumptions around PassKeys authentication.…
-
Slashdot: Microsoft Isn’t Fixing 8-Year-Old Shortcut Exploit Abused For Spying
Source URL: https://it.slashdot.org/story/25/03/18/2226205/microsoft-isnt-fixing-8-year-old-shortcut-exploit-abused-for-spying?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Microsoft Isn’t Fixing 8-Year-Old Shortcut Exploit Abused For Spying Feedly Summary: AI Summary and Description: Yes Summary: The text outlines a significant security vulnerability linked to malicious .LNK shortcut files being exploited in an eight-year-long spying campaign. Despite the findings, Microsoft categorizes the issue as a user interface problem,…
-
Unit 42: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files
Source URL: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Source: Unit 42 Title: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files Feedly Summary: A compromise of the GitHub action tj-actions/changed-files highlights how attackers could exploit vulnerabilities in third-party actions to compromise supply chains. The post Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files appeared first…
-
Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog
Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/cisa-adds-two-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent…
-
Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066
Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…
-
Cloud Blog: Cloud CISO Perspectives: 5 tips for secure AI success
Source URL: https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-5-tips-secure-ai-success/ Source: Cloud Blog Title: Cloud CISO Perspectives: 5 tips for secure AI success Feedly Summary: Welcome to the first Cloud CISO Perspectives for March 2025. Today, Royal Hansen, vice-president, Engineering, and Nick Godfrey, Office of the CISO senior director, discuss how new AI Protection capabilities in Security Command Center fit in with…
-
Hacker News: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying
Source URL: https://www.theregister.com/2025/03/18/microsoft_trend_flaw/ Source: Hacker News Title: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a vulnerability identified by Trend Micro that has been exploited in a prolonged espionage campaign, highlighting Microsoft’s response (or lack thereof) to the issue. It underscores the…
-
The Register: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying
Source URL: https://www.theregister.com/2025/03/18/microsoft_trend_flaw/ Source: The Register Title: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying Feedly Summary: ‘Only’ a local access bug but important part of N Korea, Russia, and China attack picture An exploitation avenue found by Trend Micro has been used in an eight-year-long spying campaign, but there’s no sign of a…