Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
14 Important Chromium Use-After-Free, Type Confusion Bugs Fixed
Fourteen important vulnerabilities have been discovered in Chromium, including multiple use-after-free and type confusion bugs. With a low attack complexity an…
Important Fix for c-ares DoS Bug Released
Several important security vulnerabilities have been found in the c-ares fork of the ares library, including a 0-byte UDP payload denial of service (DoS) bug (…
New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries
In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 …
Severe Vulnerabilities Reported in Microsoft Azure Bastion and Container Registry
Two "dangerous" security vulnerabilities have been disclosed in Microsoft Azure Bastion and Azure Container Registry that could have been exploited to carry ou…
Multiple Ruby Info Disclosure Vulns Fixed
Two important security bugs have been found in Ruby. It was discovered that an HTTP response splitting flaw exists in the Ruby cgi gem before 0.1.0.2, 0.2.x be…
Critical LibreOffice Code Execution Vuln Fixed
An Improper Validation of Array Index vulnerability (CVE-2023-0950) was discovered in the spreadsheet component of The Document Foundation LibreOffice 7.4 vers…
Ubuntu 6145-1: Sysstat vulnerabilities
Sysstat could be made to crash or run programs if it processed specially crafted data.
Magento, WooCommerce, WordPress, and Shopify Exploited in Web Skimmer Attack
Cybersecurity researchers have unearthed a new ongoingMagecart-style web skimmer campaign that's designed to steal personally identifiable information (PII) an…
New Zero-Click Hack Targets iOS Users with Stealthy Root-Privilege Malware
A previously unknown advanced persistent threat (APT) is targeting iOS devices as part of a sophisticated and long-running mobile campaign dubbedOperation Tria…
High-Severity ntfs-3g Buffer Overflow Vulns Fixed
Several buffer overflow vulnerabilities have been identified in ntfs-3g. With a low attack complexity and a high confidentiality, integrity and availability im…
Critical Remotely Exploitable Django Vuln Fixed
It was discovered that Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1 incorrectly handled uploading multiple files using one form field (CVE-…
Implementing Risk-Based Vulnerability Discovery and Remediation
In this day and age, vulnerabilities in software and systems pose a considerable danger to businesses, which is why it is essential to have an efficient vulner…
Linux Kernel DoS, Info Disclosure Bugs Fixed
Several important security issues have been found in the Linux kernel, including a slab-out-of-bound read problem (CVE-2023-1380), a heap out-of-bounds read/wr…
N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware
The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services (IIS) servers as an initial breach route to …
Mageia 2023-0184: libssh security update
Potential NULL dereference during rekeying with algorithm guessing. (CVE-2023-1667) Authorization bypass in pki_verify_data_signature. (CVE-2023-2283 Reference…
How To Secure Against WordPress Vulnerabilities with Predictive Analysis Detection & Automated Remediation
WordPress is one of the most popular content management systems in the world due to the ability it gives non-technical, inexperienced users to create professio…
Git 2.40.1 & Other Updates Address Three High-Impact Security Vulnerabilities
Git 2.40.1 has been released to address three new security vulnerabilities being disclosed, which have been classified as ''high-severity'' by the National Vul…
Debian: DSA-5395-1: nodejs security update
An untrusted search path vulnerability was discovered in Node.js, which could result in unexpected searching or loading ICU data when running with elevated pri…
Git 2.40.1 & Other Updates Address Three New Security Vulnerabilities
Git 2.40.1 has been released to address three new security vulnerabilities being disclosed, which have been classified as ''high-severity'' by the National Vul…
Apache Superset Vulnerability: Insecure Default Configuration Exposes Servers to RCE Attacks
The maintainers of theApache Supersetopen source data visualization software have released fixes to plug an insecure default configuration that could lead to r…
Mageia 2023-0151: openimageio security update
A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-…
Debian LTS: DLA-3396-1: redis security update
It was discovered that there was a potential remote denial of service vulnerability in Redis, a popular 'NoSQL' key-value database. Authenticated users could h…
Ubuntu 6036-1: PatchELF vulnerability
patchelf could be made to crash or read sensitive data if it opened a specially crafted file.
Fortra Sheds Light on GoAnywhere MFT Zero-Day Exploit Used in Ransomware Attacks
Fortra, the company behind Cobalt Strike, shed light on a zero-day remote code execution (RCE) vulnerability in its GoAnywhere MFT tool that has come underacti…