Security Affairs

SEPTEMBER 11, 2020

Experts reported threat actors are increasingly targeting a recently addressed vulnerability in the WordPress plugin File Manager. Researchers from WordPress security company Defiant observed a surge in the number of attacks targeting a recently addressed vulnerability in the WordPress plugin File Manager. of the popular plugin.

Passwords 119

Passwords Security IT Information Security 119

Jamf

MARCH 17, 2022

The Jamf Threat Labs recently discovered a new macOS vulnerability in the Safari browser that could lead to the execution of an unsigned and un-notarized application, without displaying security prompts to the user, by using a specially crafted zip file.

Security 92

Security 92

Security Affairs

JUNE 26, 2022

A threat actor is selling access to 50 vulnerable networks that have been compromised exploiting the recently disclosed Atlassian Confluence zero-day. A threat actor is selling access to 50 vulnerable networks that have been compromised by exploiting the recently discovered Atlassian Confluence zero-day flaw ( CVE-2022-26134 ).

Access 98

Access Ransomware Security Information Security 98

Security Affairs

FEBRUARY 4, 2022

An alleged Chinese threat actor is actively attempting to exploit a zero-day vulnerability in the Zimbra open-source email platform. An alleged Chinese threat actor, tracked as TEMP_Heretic , is actively attempting to exploit a zero-day XSS vulnerability in the Zimbra open-source email platform. Pierluigi Paganini.

Phishing 97

Phishing Cybersecurity Access Security 97

Data Breach Today

FEBRUARY 28, 2024

UNC5325 Can Remain in Hacked Devices Despite Factory Reset and Patches Chinese threat actors are continuing to persist after exploiting the recent Ivanti Connect Secure VPN vulnerability even after factory resets, system upgrades and patches.

Security 296

Security 296

Jamf

OCTOBER 5, 2022

Jamf Threat Labs recently discovered a new macOS vulnerability in Archive Utility that could lead to the execution of an unsigned and unnotarized application without displaying security prompts to the user, by using a specially crafted archive. We reported our findings to Apple on May 31, 2022, and in macOS Monterey 12.5

Archiving 98

Archiving Security IT 98

Data Breach Today

FEBRUARY 8, 2024

New Report Shows a Surge in OT/IoT Threats and a 123% Increase in Hacking Attempts Threats to critical infrastructure are on the rise, as threat actors continue to scan networks, attack networks and devices, and try to get past access controls.

IoT 295

IoT Manufacturing Access 295

Outpost24

NOVEMBER 26, 2021

Using Mitre Att&CK with threat intelligence to improve Vulnerability Management. Threat Intelligence. Risk Based Vulnerability Management. Threat actors are constantly evolving their tactics and techniques in the attack lifecycle and infiltrate company infrastructure. Florian Barre. Fri, 11/26/2021 - 02:31.

Risk 75

Risk 75

Security Affairs

FEBRUARY 27, 2020

Experts warn that hackers are actively scanning the Internet for Microsoft Exchange Servers vulnerable in the attempt to exploit the CVE-2020-0688 RCE. The vulnerability resides in the Exchange Control Panel (ECP) component, the root cause of the problem is that Exchange servers fail to properly create unique keys at install time.

Authentication 106

Authentication Data breaches Communications Access 106

Data Breach Today

NOVEMBER 22, 2023

Kinsing Threat Actor Observed Targeting Vulnerable Cloud Environments With New Flaw The Cybersecurity and Infrastructure Security Agency is requiring federal agencies to patch Linux devices on their networks and urging private sector organizations to do the same after security researchers observed threat actors exploiting a new vulnerability on many (..)

Cloud 271

Cloud Cybersecurity Security 271

Data Breach Today

MARCH 21, 2024

Researchers Spot Vulnerability in Application-Layer Communication Protocol A new type of denial-of-service threat can disrupt an estimated 300,000 internet hosts that are at risk of exploitation.

Communications 280

Communications Information Security Risk Security 280

IG Guru

MARCH 2, 2022

The post Vulnerable U.S. electric grid facing threats from Russia and domestic terrorists via CBS News appeared first on IG GURU. Check out the article here.

Information governance 87

Information governance Risk Government Security 87

The Last Watchdog

FEBRUARY 7, 2022

When new vulnerabilities re announced or flaws are discovered in public or “off the shelf” applications, several things happen. As attackers started scanning for targets, our research team repurposed their techniques resulting in a tool that we used to help our customers find vulnerable API endpoints.

Authentication 210

Authentication Communications Risk Security 210

Data Breach Today

JANUARY 5, 2024

Data-Poisoning Attacks Are Critical Threat to Machine Learning Security, NIST Warns Machine learning systems are vulnerable to cyberattacks that could allow hackers to evade security and prompt data leaks, scientists at the National Institute of Standards and Technology warned.

Security 311

Security 311

Data Breach Today

NOVEMBER 16, 2023

Buying Master MSSP Will Bring MDR, SOC and Vulnerability Management to MSPs, MSSPs SonicWall acquired a longtime master MSSP partner to bring MDR, SOC and vulnerability management capabilities to its managed service providers.

Cloud 273

Cloud IT 273

Data Breach Today

JANUARY 31, 2024

water sector testified to the House subcommittee on environment, manufacturing and critical materials that entities across the country face funding and resource disparities as the increasingly vulnerable industry faces emerging threats from domestic and foreign cyber actors.

Manufacturing 274

Manufacturing Cybersecurity Risk 274

Data Breach Today

JUNE 2, 2023

Mandiant Said TTPs of Threat Group Behind Exploiting MOVEit Appear Similar to FIN11 Adversaries have taken advantage of a zero-day vulnerability in Progress Software's managed file transfer product to deploy web shells and steal data, Mandiant found.

273

273

Data Breach Today

FEBRUARY 9, 2024

Joe Sullivan Also Discusses Identity Management, AI, State of Information Sharing In the latest weekly update, Joe Sullivan, CEO of Ukraine Friends, joins three editors at ISMG to discuss the challenges of being a CISO in 2024, growing threats from disinformation, vulnerabilities in MFA, AI's role in cybersecurity, and the obstacles to public-private (..)

Cybersecurity 265

Cybersecurity 265

Data Breach Today

MARCH 16, 2023

Microsoft Patches Another SmartScreen Signature-Based Vulnerability A financial motivated hacking group has been exploiting a now-patched zero-day vulnerability in the Windows operating system to deliver ransomware. Google Threat Analysis Group attributed the campaign to Magniber ransomware group.

Ransomware 347

Ransomware IT 347

Data Breach Today

OCTOBER 18, 2023

Pyongyang Hackers Exploiting Critical TeamCity Server Bug North Korean nation-state threat actors are exploiting a critical remote code execution vulnerability affecting multiple versions of a DevSecOps tool - a high-risk development, especially in light of Pyongyang hackers' recent track record of supply chain hacks.

Risk 317

Risk 317

Data Breach Today

SEPTEMBER 26, 2023

Experts Emphasize Proactive Security Measures and Resilience to Mitigate Threats Information Security Media Group recently concluded its Cybersecurity Summit: London, which brought together industry leaders for a day of informative sessions covering a diverse range of critical cybersecurity topics, including CISOs' vulnerability to liability, ransomware (..)

Cybersecurity 271

Cybersecurity Ransomware Information Security Security 271

Data Breach Today

OCTOBER 24, 2023

New Capital, Debt Funding Will Help Censys Analyze History of Vulnerable Data A threat hunting and exposure management startup led by ex-OneLogin CEO Brad Brooks received $75 million to invest in cloud and analytics and growing globally.

Analytics 266

Analytics Cloud 266

Data Breach Today

DECEMBER 8, 2023

Also: Top Threat Actors Are Targeting Hospitals; Remembering Steve Katz In the latest weekly update, editors at ISMG discuss the rampant rise in healthcare sector attacks and breaches in 2023, the most common vulnerabilities and targets, and remember the life of the Steve Katz, the world's first CISO who inspired generations of security leaders.

Data breaches 299

Data breaches Security 299

Data Breach Today

DECEMBER 29, 2023

Google OAuth2 Vulnerability Being Actively Abused by Attackers, Researchers Warn A previously undiscovered critical exploit can allow threat actors to gain persistent, unauthorized access to Google services and connected accounts even after users have changed their passwords, cybersecurity researchers warn.

Passwords 272

Passwords Cybersecurity Access 272

Data Breach Today

AUGUST 14, 2023

Vulnerabilities Found in CyberPower and Dataprobe Products Multiple vulnerabilities in data center power management systems and supply technologies enable threat actors to gain unauthorized access and perform remote code injection. The attackers can chain multiple vulnerabilities to gain full access to data center systems.

Access 238

Access 238

Data Breach Today

OCTOBER 18, 2023

While RARLabs Patched Flaw, 'Many Users' Don't Appear to Have Updated the Software Nation-state hackers are targeting a vulnerability in WinRAR, a popular Windows utility for archiving files, warns Google’s Threat Analysis Group, which said it has seen "government-backed hacking groups" who hail from multiple countries, including China and Russia, (..)

Archiving 297

Archiving Government IT 297

Data Breach Today

DECEMBER 5, 2023

Hugging Face Fixes Flaw; Meta, Other Tech Giants Revoke Vulnerable Tokens Security researchers could access and modify an artificial intelligence code generation model developed by Facebook after scanning for API access tokens on AI developer platform Hugging Face and code repository GitHub.

Artificial Intelligence 264

Artificial Intelligence Risk Access Security 264

Data Breach Today

JUNE 15, 2023

Targets Include Southeast Asian Foreign Ministry, Foreign Trade Offices in Taiwan Chinese hackers in a state-run operation compromised hundreds of organizations through a zero-day vulnerability in a popular email security appliance, warns cyber threat intelligence firm Mandiant.

Security 270

Security 270

Data Breach Today

JUNE 16, 2023

New Vulnerability Allows Threat Actors to Modify, Disclose MOVEit Database Content The latest vulnerability in MOVEit's managed file transfer application could lead to escalated privileges and unauthorized access to customer environments.

Access 269

Access 269

Data Breach Today

AUGUST 6, 2022

Vulnerability Allowed Threat Actors to Gain Access to Personal Information Twitter confirms that a zero-day vulnerability allowed threat actors to gain access to the personal information of 5.4 The company was notified about this specific vulnerability in Twitter's systems through their bug bounty program in January.

Access 272

Access 272

Data Breach Today

JUNE 21, 2023

APT Group Masqueraded as Indonesia's Foreign Ministries in Emails to G7 Officials Suspected Chinese APT groups exploited a 17-year-old Microsoft Office vulnerability in May to launch malware attacks against foreign government officials who attended a G7 summit in Hiroshima, Japan.

Government 338

Government 338

Data Breach Today

NOVEMBER 16, 2023

Zimbra Patched the Cross-Site Scripting Vulnerability on July 25 A zero-day flaw in the Zimbra Collaboration email server proved to be a bonanza for hackers as four distinct threat actors exploited the bug to steal email data and user credentials, says Google.

273

273

Data Breach Today

AUGUST 18, 2023

Kaspersky Falls From Leaderboard as Deliberate Decision Made to Nix Russian Firms Recorded Future has joined CrowdStrike and Google atop Forrester's external threat intelligence services rankings, while Kaspersky tumbled from the leaders category.

246

246

Security Affairs

APRIL 20, 2024

Threat actors exploited a critical zero-day vulnerability in the CrushFTP enterprise in targeted attacks, Crowdstrike experts warn. CrushFTP has notified users of a virtual file system escape vulnerability impacting their FTP software, which could potentially enable users to download system files. ” reads the advisory.

Security 123

Security IT Information Security 123

Threatpost

JULY 11, 2022

Find out why a vital component of vulnerability management needs to be the capacity to prioritize from Mariano Nunez, CEO of Onapsis and Threatpost Infosec Insiders columnist.

89

89