Tag

Zero Day Flaw

All articles tagged with #zero day flaw

vulnerability-email-security2 years ago•2 min saved

Global Government Data Breach: Zimbra Zero-Day Exploited by Multiple Hacker Groups

Four hacker groups have exploited a zero-day flaw in the Zimbra Collaboration email software, allowing them to steal email data, user credentials, and authentication tokens. The vulnerability, tracked as CVE-2023-37580, is a reflected cross-site scripting (XSS) flaw that was addressed by Zimbra in July 2023. The attacks occurred even after the initial fix was made public on GitHub, highlighting the importance of promptly applying patches to mail servers. The campaigns targeted government organizations in Greece, Moldova, Tunisia, and Vietnam, demonstrating the need for thorough auditing of mail server applications.

via The Hacker News|

#email-software #hacker-groups #vulnerability-email-security

cybersecurity2 years ago•1 min saved

"Cisco Unveils Zero-Day Exploits and Pledges Swift Fixes for Thousands of Devices"

Cisco has issued a warning about a zero-day flaw in its IOS XE software that has been actively exploited by unknown threat actors to deploy a malicious Lua-based implant on vulnerable devices. The flaw, tracked as CVE-2023-20273, allows for privilege escalation through a web UI feature and has been used in conjunction with another vulnerability, CVE-2023-20198, to create an exploit chain. Cisco has identified a fix for both vulnerabilities, which will be available to customers starting October 22, 2023. In the meantime, it is recommended to disable the HTTP server feature. Over 41,000 Cisco devices running the vulnerable software are estimated to have been compromised, primarily affecting smaller entities and individuals.

via The Hacker News|

#cisco #cybersecurity #malicious-implant

technology2 years ago•2 min saved

Apple's WebKit Security Updates Cause Browsing Issues and Emergency Update Rollbacks

Apple's emergency security updates, released to address a zero-day bug, have inadvertently caused browsing issues on some websites. User-agent detection for services like Zoom, Facebook, and Instagram has been broken, resulting in errors when using Safari on patched devices. Apple has acknowledged the issue and plans to release new updates soon. Users who have already installed the updates and are experiencing browsing problems are advised to remove them. This zero-day flaw is the latest in a series of vulnerabilities that Apple has patched this year, with a total of ten zero-day flaws being addressed so far.

via BleepingComputer|

#apple #browsing-issues #security-updates

network-security-cyber-espionage2 years ago•3 min saved

Rising Sophistication of Chinese Hackers in Cyber Espionage Attacks.

Chinese hackers, identified as UNC3886, have exploited a zero-day vulnerability in the Fortinet FortiOS operating system to deploy backdoors onto Fortinet and VMware solutions and maintain persistent access to victim environments. The vulnerability, tracked as CVE-2022-41328, was patched by Fortinet on March 7, 2023. The attacks mounted by UNC3886 targeted Fortinet's FortiGate, FortiManager, and FortiAnalyzer appliances to deploy two different implants such as THINCRUST and CASTLETAP. The group was previously tied to another intrusion set targeting VMware ESXi and Linux vCenter servers as part of a hyperjacking campaign designed to drop backdoors such as VIRTUALPITA and VIRTUALPIE.

via The Hacker News|

#chinese-hackers #cyber-espionage #fortinet