Security Affairs

FEBRUARY 20, 2025

The company pointed out that only authenticated users with existing access to the NetScaler Console can exploit this vulnerability. “The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization. NetScaler Console 14.1

Authentication 297

Authentication Cloud Access Security 297

Security Affairs

JANUARY 19, 2025

The vulnerability allows authenticated attackers with Subscriber access to exploit a missing capability check, leading to information disclosure. It is installed on over one million WordPress sites, owners use this plugin to enhance user experience, boost SEO rankings, and reduce server load. ” reads the advisory published by WordPress.

Metadata 315

Metadata Authentication Consumer Services Cloud 315

Security Affairs

OCTOBER 19, 2024

Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Overlapping indicators link these cases to prior Fog and Akira ransomware attacks.

IT 327

IT Ransomware Authentication Cybersecurity 327

Security Affairs

NOVEMBER 7, 2024

CVE-2024-51567 – is an incorrect default permissions vulnerability in CyberPanel (prior to patch 5b08cd6) that allows remote attackers to bypass authentication and execute arbitrary commands through /dataBases/upgrademysqlstatus by manipulating the statusfile property with shell metacharacters, bypassing secMiddleware.

IT 314

IT Authentication Cybersecurity Risk 314

Security Affairs

MAY 24, 2025

. “Implement basic cyber hygiene to include being suspicious, robust passwords, multifactor authentication, and installation of antivirus tools.” ” concludes the report.

Phishing 283

Phishing Authentication Passwords Communications 283

Krebs on Security

DECEMBER 18, 2024

Griffin said a follow-up investigation revealed the attackers had used his Gmail account to gain access to his Coinbase account from a VPN connection in California, providing the multi-factor code from his Google Authenticator app. You may also wish to download Google Authenticator to another mobile device that you control.

Authentication 363

Authentication Phishing Access Security 363

Security Affairs

FEBRUARY 16, 2025

” Device code phishing attacks exploit authentication flows to steal tokens, granting attackers access to accounts and data. Upon clicking the meeting invitation embedded in the message, recipients are prompted to authenticate using a threat actor-generated device code. ” continues the report.

Phishing 287

Phishing Authentication Access Government 287

Security Affairs

JULY 13, 2025

If an attacker can manipulate a session file, whose name is tied to a cookie (UID), they can trigger code execution by performing any authenticated action on the server, such as listing directory contents via the web interface. .” This happens because the SessionModule.lua script loads and runs session files without proper validation.

Authentication 219

Authentication Passwords Ransomware Access 219

Security Affairs

MAY 17, 2025

Always confirm authenticity before responding, and contact security officials or the FBI if uncertain. Enable and protect two-factor authentication and never share OTP codes. Be cautious of realistic fakes using public photos or voice cloning. To avoid fraud or data loss, never share sensitive info with unknown contacts.

Government 307

Government Authentication Access Security 307

Security Affairs

OCTOBER 21, 2024

The Internet Archive was breached again, attackers hacked its Zendesk email support platform through stolen GitLab authentication tokens. Hunt also verified the authenticity of the information included in the stolen archive. Hunt will add the information of the impacted users to HIBP very soon.

Archiving 321

Archiving Data breaches Authentication File names 321

Security Affairs

NOVEMBER 13, 2024

is a buffer overflow issue that an authenticated attacker could exploit. “Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.” is an improper input validation issue that can be exploited remotely without authentication.

IT 288

IT Authentication Communications Access 288

Security Affairs

NOVEMBER 8, 2024

Cybersecurity and Infrastructure Security Agency (CISA) added a Palo Alto Expedition Missing Authentication Vulnerability, tracked as CVE-2024-5910 , to its Known Exploited Vulnerabilities (KEV) catalog.

Authentication 292

Authentication Cybersecurity Access Communications 292

Security Affairs

JANUARY 16, 2025

The botnet uses compromised MikroTik devices as SOCKS proxies, masking malicious traffic origins and enabling other actors to exploit them without authentication, amplifying its scale. The botnet’s SOCKS proxy setup enables access for hundreds of thousands of compromised machines. ” reads the report published by Infoblox.

File names 348

File names Authentication Archiving Access 348

Security Affairs

OCTOBER 17, 2024

The vulnerability is an authenticated SQL injection vulnerability in HCX, it was privately reported to VMware by Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) through the Trend Micro Zero Day Initiative (ZDI). “An authenticated SQL injection vulnerability in HCX was privately reported to VMware.

Authentication 329

Authentication Cloud IT Information Security 329

Security Affairs

JUNE 10, 2025

. “RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.” ” The flaw resides in SAP’s Remote Function Call (RFC) framework lets authenticated attackers bypass key checks and escalate privileges, risking app integrity and availability.

Security 253

Security MDM Authentication Risk 253

Krebs on Security

NOVEMBER 12, 2024

The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451 , a spoofing flaw that could reveal Net-NTLMv2 hashes , which are used for authentication in Windows environments. Narang notes that CVE-2024-43451 is the third NTLM zero-day so far this year.

Authentication 292

Authentication Passwords Access Cybersecurity 292

Security Affairs

NOVEMBER 15, 2024

The malware could harvest a huge trove of data from infected systems, including cookies, autofill, cryptocurrency wallets, 2FA authenticators, password managers, and email client information. Glove Stealer is a.NET-based information stealer that targets browser extensions and locally installed software to steal sensitive data.

Encryption 292

Encryption File names Phishing Authentication 292

Security Affairs

JANUARY 30, 2025

.” The researchers noted that the leak could have allowed attackers to take full control of the database and potentially escalate privileges within the DeepSeek environment, without any authentication. The experts used ClickHouses HTTP interface and accessed the /play path to execute arbitrary SQL queriesvia the browser.

Metadata 302

Metadata Authentication Access Passwords 302

Security Affairs

FEBRUARY 4, 2025

The two flaws are, respectively, a remote code execution issue and an authentication bypass vulnerability. The authentication bypass security vulnerability PSV-2021-0117 impacts the following product models: WAX206, the issue was fixed in firmware version 1.0.5.3 XR1000v2, the issue was fixed in firmware version 1.1.0.22

Authentication 274

Authentication Security IT Information Security 274

Security Affairs

NOVEMBER 19, 2024

CVE-2024-0012 is a vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass authentication and gain administrator privileges. This access enables administrative actions, configuration tampering, or exploitation of other vulnerabilities like CVE-2024-9474.

IT 274

IT Authentication Cybersecurity Risk 274

Security Affairs

FEBRUARY 19, 2025

The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user. Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025.

Authentication 265

Authentication Honeypots Cybersecurity Access 265

Security Affairs

FEBRUARY 19, 2025

The second vulnerability, tracked CVE-2025-26466 (CVSS score: 5.9), affects both the OpenSSH client and server, allowing a pre-authentication denial-of-service attack. ” The OpenSSH client and server are vulnerable (CVE-2025-26466) to a pre-authentication denial-of-service (DoS) attack.

Authentication 306

Authentication Systems administration Security IT 306

Security Affairs

NOVEMBER 26, 2024

Attackers can exploit the SSL VPN gateway by accessing the filesystem via an HTTP header flags attribute and a vulnerable URL without authentication. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. ” reads the advisory.

IT 278

IT Authentication Cybersecurity Risk 278

Security Affairs

JANUARY 31, 2025

In October 2024, VMware warned customers of the availability of a proof-of-concept (PoC) exploit code for another authentication bypass vulnerability, tracked as CVE-2023-34051 , in VMware Aria Operations for Logs (formerly known as vRealize Log Insight). is an authentication bypass vulnerability in VMware Aria Operations for Logs.

Authentication 266

Authentication Cloud Cybersecurity Access 266

Security Affairs

APRIL 19, 2025

A remote authenticated attacker can exploit the flaw to inject arbitrary commands as a nobody user, which could potentially lead to arbitrary code execution. The vulnerability is an OS Command Injection Vulnerability in the SMA100 management interface. ” reads the advisory. .

Passwords 267

Passwords Authentication Access Cybersecurity 267

Security Affairs

FEBRUARY 15, 2025

“ An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. reads the advisory published by Palo Alto Networks.

Honeypots 257

Honeypots Authentication Access Cybersecurity 257

Security Affairs

NOVEMBER 17, 2024

The Really Simple Security plugin, formerly Really Simple SSL, is a popular WordPress tool that enhances website security with features like login protection, vulnerability detection, and two-factor authentication. ” This vulnerability only impacts WordPress sites who have enabled “Two-Factor Authentication” in the plugin settings.

Security 187

Security Authentication Access IT 187

Security Affairs

OCTOBER 28, 2024

The correct IAM solution is that roof and can allow you to integrate: Policy configuration Multi-factor authentication (MFA) Single sign-on (SSO) And more, for all cloud and web-based apps. Integrations As you’re looking to expand your security influence, it helps to have things under one roof.

B2B 315

B2B Cybersecurity Risk Authentication 315

Security Affairs

NOVEMBER 15, 2024

CVE-2024-9464 (CVSS 9.3) – An authenticated OS command injection vulnerability allows attackers root access, leading to data exposure similar to CVE-2024-9463.

IT 274

IT Passwords Authentication Access 274

Krebs on Security

JULY 8, 2025

Mike Walters , co-founder of Action1 , said CVE-2025-49719 can be exploited without authentication, and that many third-party applications depend on SQL server and the affected drivers — potentially introducing a supply-chain risk that extends beyond direct SQL Server users.

Authentication 226

Authentication Access Security Risk 226

Security Affairs

MARCH 13, 2025

GitLab addressed two critical authentication bypass vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The company addressed nine vulnerabilities, including the two critical ruby-saml authentication bypass issues respectively tracked as CVE-2025-25291 and CVE-2025-25292. . ” continues the analysis.

Authentication 171

Authentication Libraries Data breaches Security 171

Security Affairs

DECEMBER 11, 2024

Ivanti addressed a critical authentication bypass vulnerability impacting its Cloud Services Appliance (CSA) solution. Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-11639 (CVSS score of 10), in its Cloud Services Appliance (CSA) solution. ” reads the advisory published by the company.

IT 264

IT Authentication Cloud Access 264

Security Affairs

JUNE 4, 2025

allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.” This vulnerability allows authenticated users to execute arbitrary commands via PHP object deserialization. x before 1.6.11

Authentication 287

Authentication Risk Communications Information Security 287