Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Malicious npm Packages Mimicking 'noblox.js' Compromise Roblox Developers’ Systems
Roblox developers are the target of a persistent campaign that seeks to compromise systems through bogus npm packages, once again underscoring how threat actor…
Atlassian Confluence Vulnerability Exploited in Crypto Mining Campaigns
Threat actors are actively exploiting a now-patched, critical security flaw impacting the Atlassian Confluence Data Center and Confluence Server to conduct ill…
Mageia 2024-0282: nodejs & yarnpkg Security Advisory Updates
Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network imp…
Hardcoded Credential Vulnerability Found in SolarWinds Web Help Desk
SolarWinds has issued patches to address a new security flaw in its Web Help Desk (WHD) software that could allow remote unauthenticated users to gain unauthor…
Researchers Uncover Vulnerabilities in AI-Powered Azure Health Bot Service
Cybersecurity researchers have discovered two security flaws in Microsoft's Azure Health Bot Service that, if exploited, could permit a malicious actor to achi…
Closing the Loop: The Long-Overdue Fix for the 0.0.0.0 Day Vulnerability
At a time when security breaches have become increasingly sophisticated, an oversight that had persisted across major browsers for years has now been addressed…
Gentoo: GLSA-202408-24: Ruby on Rails: Remote Code ExecutionSecurity Advisory Updates
A vulnerability has been discovered in Ruby on Rails, which can lead to remote code execution via serialization of data.
0.0.0.0 Day: 18-Year-Old Browser Vulnerability Impacts MacOS and Linux Devices
Cybersecurity researchers have discovered a new "0.0.0.0 Day" impacting all major web browsers that malicious websites could take advantage of to breach local …
Fedora 39: chromium 2024-ff743391c3 Security Advisory Updates
update to 127.0.6533.88 Critical CVE-2024-6990: Uninitialized Use in Dawn High CVE-2024-7255: Out of bounds read in WebTransport High CVE-2024-7256: Insufficie…
Fedora 40: chromium 2024-3a1a0a664e Security Advisory Updates
update to 127.0.6533.88 Critical CVE-2024-6990: Uninitialized Use in Dawn High CVE-2024-7255: Out of bounds read in WebTransport High CVE-2024-7256: Insufficie…
Closing the Door on CVE-2024-29510: Understanding and Mitigating Ghostscript's Latest RCE Threat
Recently, open-source security was rocked by the discovery of an alarming Remote Code Execution (RCE) vulnerability within the Ghostscript document conversion …
Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform
Cybersecurity researchers have disclosed a privilege escalation vulnerability impacting Google Cloud Platform's Cloud Functions service that an attacker could …
Critical Unpatched Flaws Disclosed in Popular Gogs Open-Source Git Service
Four unpatched security flaws, including three critical ones, have been disclosed in the Gogs open-source, self-hosted Git service that could enable an authent…
Mageia 2024-0240: wget Security Advisory Updates
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was su…
Critical SQLi Vulnerability Found in Fortra FileCatalyst Workflow Application
A critical security flaw has been disclosed in Fortra FileCatalyst Workflow that, if left unpatched, could allow an attacker to tamper with the application dat…
Debian LTS: DLA-3834-1: netty Security Advisory Updates
Julien Viet discovered that Netty, a Java NIO client/server socket framework, was vulnerable to allocation of resources without limits or throttling due to the…
Snowflake Warns: Targeted Credential Theft Campaign Hits Cloud Customers
Cloud computing and analytics company Snowflake said a "limited number" of its customers have been singled out as part of a targeted campaign."We have not iden…
New Research Reveals Linux Vulnerability Exploitation Has Doubled
Recently conducted research by Kaspersky indicates an alarming rise in cyberattacks using exploits against Linux systems. Data from Kaspersky Security Network …
Thunderbird DoS, Info Disclosure Vulns Fixed in Ubuntu and Debian
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and newsgroup client. …
Researchers Uncover 11 Security Flaws in GE HealthCare Ultrasound Machines
Security researchers have disclosed almost a dozen security flaws impacting the GE HealthCare Vivid Ultrasound product family that could be exploited by malici…
Mageia 2024-0173: glibc Security Advisory Updates
Stack-based buffer overflow in netgroup cache: If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent cli…
Mageia 2024-0171: tpm2-tss Security Advisory Updates
A flaw was found in the tpm2-tss package, where there was no check that the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows a…
When is One Vulnerability Scanner Not Enough?
Like antivirus software, vulnerability scans rely on a database of known weaknesses.That’s why websites like VirusTotal exist, to give cyber practitioners a ch…
Mageia 2024-0159: guava Security Advisory Updates
A bug that could allow an attacker with access to the machine to potentially access data in a temporary directory created by the Guava. (CVE-2020-8908) Predict…