eSecurity Planet

JULY 1, 2024

MOVEit Transfer had an authentication bypass that affected 2,700 instances. Apple issued updates for AirPods’ Bluetooth authentication bypass flaw. To improve security, users should update software on a regular basis, establish strong authentication procedures, and limit access to key resources.

Risk 63

Risk Authentication Firmware Software 63

eSecurity Planet

JUNE 24, 2024

ASUS fixed authentication bypass and buffer overflow issues in its routers. Cybersecurity researchers discovered a buffer overflow flaw in Intel Core processor firmware causing Phoenix Technology to release patches. The problem: Security researchers reported a buffer overflow vulnerability ( CVE-2024-0762 , CVSS 7.5)

Firmware 63

Firmware Passwords Software Risk 63

eSecurity Planet

OCTOBER 24, 2023

Strengthen Router Security: Enhance your router’s security by changing default login credentials. Regularly update router firmware to patch vulnerabilities and close potential avenues of attack. Android users should disable installations from unknown sources, ensuring app authenticity.

Malware 117

Malware Antivirus Software Passwords 117

eSecurity Planet

AUGUST 13, 2024

If exploited, the vulnerability would allow a threat actor to execute their own code within the processor’s firmware using System Management Mode (SMM). FreeBSD, an open-source operating system project, released a security bulletin about the vulnerability, which occurs in a signal handler in sshd(8).

Firmware 109

Firmware Software Wireless Security Defenses 109

eSecurity Planet

SEPTEMBER 9, 2024

Encryption and secure communication protocols: Protecting data in transit between ICS components. Patch management: Keeping software and firmware up to date to close security gaps. Firmware manipulation is particularly dangerous because it often remains undetected until significant damage occurs.

Firmware 103

Firmware Encryption Manufacturing Risk 103

eSecurity Planet

NOVEMBER 6, 2023

The Problem: Three flaws discovered by the Kubernetes security community carry CVSS severity scores of 7.6 Non-privileged threat actors can exploit these drivers to gain complete device control, execute arbitrary code, modify firmware, and escalate operating system privileges, posing a significant security risk.

Software 100

Software Education Ransomware Firmware 100

eSecurity Planet

AUGUST 13, 2024

If exploited, the vulnerability would allow a threat actor to execute their own code within the processor’s firmware using System Management Mode (SMM). FreeBSD, an open-source operating system project, released a security bulletin about the vulnerability, which occurs in a signal handler in sshd(8).

Firmware 97

Firmware Software Wireless Security Defenses 97

eSecurity Planet

MAY 27, 2024

GitHub Enterprise Server and GitLab patched their authentication bypass and XSS issues. Immediately update your QNAP devices to the most recent firmware to mitigate these issues. May 21, 2024 GitHub Enterprise Server Update Fixes SAML Authentication Bypass Type of vulnerability: Authentication bypass.

Backups 68

Backups Authentication DDOS Engineering 68

eSecurity Planet

FEBRUARY 21, 2024

Check the Firewall Hardware & Operating System After you’ve prepared all the documentation and know everyone’s roles, one of the early steps in a firewall audit process is a hardware and firmware check. Look at the hardware to see whether it fits your company’s standards and security requirements.

Firewall 111

Firewall Firmware Software Risk 111

eSecurity Planet

SEPTEMBER 2, 2024

Devices running SonicWall Firewall Gen5, Gen6, and Gen 7 are vulnerable to network-based threats that require no user interaction or authentication. The fix: Upgrade to SonicWall’s firmware updates for Gen 5 (to version 5.9.2.14-13o), 13o), Gen 6 (to version 6.5.4.15.116n), and Gen 7 (to any version above 7.0.1-5035).

Risk 58

Risk Firewall Firmware Engineering 58

eSecurity Planet

JUNE 10, 2024

The exploit combines an authentication bypass ( CVE-2024-4358 ) with a deserialization issue ( CVE-2024-1800 ). The authentication bypass permits the establishment of rogue admin accounts, but the deserialization flaw allows remote code execution, potentially giving attackers complete control over the affected servers.

Malware 65

Malware Authentication Software Telecommunications 65

eSecurity Planet

DECEMBER 7, 2023

The three innovators and MIT patented the RSA algorithm, a proprietary system available through RSA Security until its public release in 2000. The RSA algorithm remains the most popular public key cryptographic system today and introduced the concept of digital signatures for authentication outside of academia.

Encryption 108

Encryption Passwords Authentication Password Management 108

eSecurity Planet

MAY 20, 2024

doesn’t always require authentication for SSID during a Wi-Fi session. Note that some DIR-600 devices are end of life, so D-Link won’t release any firmware updates for these. This attack can occur on any operating system and Wi-Fi client.

VPN 63

VPN Firmware Malware Software 63

eSecurity Planet

MAY 2, 2024

Password manager : Stores passwords securely, enforces quality, permits safe internal and external sharing, and ties into HR software for effective off-boarding of users. Multi-factor authentication : Protects stolen credentials against use by requiring more than a simple username and password combination for access to resources.

Cybersecurity 108

Cybersecurity DDOS Penetration Testing Passwords 108

eSecurity Planet

JULY 8, 2024

OpenSSH resolved a signal handler race problem, Juniper Networks managed an authentication bypass, and CocoaPods faced supply chain attack concerns. Regularly update and follow secure development methods, particularly in open-source projects. Cisco discovered a command injection issue, while a side-channel attack exposed Intel CPUs.

Risk 63

Risk Authentication Firmware Surveillance 63

SecureList

NOVEMBER 25, 2024

One of them is CVE-2024-0204, which allows attackers to bypass authentication in the GoAnywhere MFT. Many IoT devices rely on remote servers for control, but the security practices of the companies managing these servers are often unclear, resulting in new potential attack vectors on their infrastructure.

IoT 115

IoT Energy and Utilities Phishing Cryptocurrency 115

eSecurity Planet

MARCH 4, 2024

February 27, 2024 Ransomware Gangs Target Unpatched ScreenConnect Servers Type of vulnerability: Authentication bypass and path traversal. Read more about how websites and application vulnerability scanners can proactively help development teams catch issues.

IoT 115

IoT Internet Internet Ransomware 115