Security Affairs

NOVEMBER 14, 2023

VMware disclosed a critical bypass vulnerability in VMware Cloud Director Appliance that can be exploited to bypass login restrictions when authenticating on certain ports. “VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5

Authentication 138

Authentication Hacking Information Security 138

Security Affairs

FEBRUARY 26, 2024

Recently the leak of a collection of files apparently stolen from the Chinese government hacking contractor, I-Soon, exposed Chinese hacking capabilities. Recently someone has leaked on GitHub [ 1 , 2 ] a collection of files apparently stolen from the Chinese hacking firm, I-Soon.

Hacking 135

Hacking Government Spyware Marketing 135

Security Affairs

APRIL 25, 2023

Google announced that its Authenticator app for Android and iOS now supports Google Account synchronization. Google announced that its Google Authenticator app for both iOS and Android now supports Google Account synchronization that allows to safely backup users one-time codes to their Google Account. ” reads the announcement.

Authentication 98

Authentication Accountability Backups Education 98

Security Affairs

MAY 2, 2024

Threat actors breached the Dropbox Sign production environment and accessed customer email addresses and hashed passwords Cloud storage provider DropBox revealed that threat actors have breached the production infrastructure of the DropBox Sign eSignature service and gained access to customer information and authentication data.

Hacking 134

Hacking Authentication Passwords Accountability 134

Security Affairs

AUGUST 2, 2022

VMware patched a critical authentication bypass security flaw, tracked as CVE-2022-31656, impacting local domain users in multiple products. VMware has addressed a critical authentication bypass security flaw, tracked as CVE-2022-31656, impacting local domain users in multiple products. Pierluigi Paganini.

Authentication 124

Authentication Hacking Information Security 124

Security Boulevard

JUNE 26, 2022

How Information Security Breaks The Classic IT Model. How does information security fit into the producer/consumer model? In some cases, yes, information security does fit into this in several ways: a. Number of consumers requiring multi-factor authentication for Zero-trust access.

Information Security 98

Information Security Technology Marketing Cyber Insurance 98

Security Affairs

SEPTEMBER 15, 2021

Microsoft announced that users can access their consumer accounts without providing passwords and using more secure authentication methods. SecurityAffairs – hacking, passwordless authentication). The post Microsoft announces passwordless authentication for consumer accounts appeared first on Security Affairs.

Authentication 126

Authentication Accountability Passwords Phishing 126

Security Affairs

JANUARY 31, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds Apple improper authentication bug to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple improper authentication bug, tracked as CVE-2022-48618 , to its Known Exploited Vulnerabilities (KEV) catalog.

Authentication 134

Authentication Cybersecurity Risk Information Security 134

Security Affairs

JUNE 29, 2023

Data protection firm Arcserve addressed an authentication bypass vulnerability in its Unified Data Protection (UDP) backup software. Data protection vendor Arcserve addressed a high-severity bypass authentication flaw, tracked as CVE-2023-26258, in its Unified Data Protection (UDP) backup software. Arcserve released UDP 9.1

Authentication 98

Authentication Backups Ransomware Software 98

Security Affairs

JULY 29, 2022

Therefore, strong authentication methods are needed. Therefore, strong authentication methods are needed to improve security without hindering user convenience. What is Strong Authentication? The IAM Security Boundary Strong authentication is a critical component of modern-day identity and access management.

Authentication 126

Authentication Passwords Data privacy Identity Theft 126

Security Affairs

SEPTEMBER 7, 2022

In the digital age, authentication is paramount to a strong security strategy. Which are the challenges of user authentication? In the digital age, authentication is paramount to a strong security strategy. User authentication seems easy, but there are inherent challenges to be aware of. User Authentication.

Authentication 102

Authentication Passwords Risk Education 102

Security Affairs

MAY 30, 2023

PyPI is going to enforce two-factor authentication (2FA) for all project maintainers by the end of this year over security concerns. Due to security concerns, PyPI will be mandating the use of two-factor authentication (2FA) for all project maintainers by the end of this year. ” continues the announcement. .

Authentication 98

Authentication Accountability Hacking Malware 98

Security Affairs

APRIL 9, 2024

December 14, 2023: Vendor requests extension March 22, 2024: Patch release April 09, 2024: Public release of this report Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, smart TVs) Most of the Internet-facing devices are in South Korea, Hong Kong, the U.S.,

Hacking 141

Hacking Internet Internet Authentication 141

Security Affairs

SEPTEMBER 9, 2021

Zoho urges customers to address an authentication bypass vulnerability in its ManageEngine ADSelfService Plus that is actively exploited in the wild. Zoho has released a security patch to address an authentication bypass vulnerability, tracked as CVE-2021-40539, in its ManageEngine ADSelfService Plus. Pierluigi Paganini.

Authentication 132

Authentication Password Management Passwords Internet 132

Security Affairs

APRIL 24, 2022

Atlassian fixed a critical flaw in its Jira software, tracked as CVE-2022-0540 , that could be exploited to bypass authentication. Atlassian has addressed a critical vulnerability in its Jira Seraph software, tracked as CVE-2022-0540 (CVSS score 9.9), that can be exploited by an unauthenticated attacker to bypass authentication.

Authentication 100

Authentication Software Hacking Risk 100

Security Affairs

MARCH 27, 2022

Sophos has fixed an authentication bypass vulnerability, tracked as CVE-2022-1040, that resides in the User Portal and Webadmin areas of Sophos Firewall. “An authentication bypass vulnerability allowing remote code execution was discovered in the User Portal and Webadmin of Sophos Firewall and responsibly disclosed to Sophos. .”

Firewall 100

Firewall Authentication VPN Hacking 100

Security Affairs

DECEMBER 26, 2023

The Rhysida ransomware group claimed to have hacked Abdali Hospital, a multi-specialty hospital located in Jordan. pic.twitter.com/6uHMDcNhTC — Dominic Alvieri (@AlvieriD) December 26, 2023 The group published images of stolen documents as proof of the hack. Abdali Hospital provides care to patients in numerous specialties.

Ransomware 140

Ransomware Hacking Manufacturing Healthcare 140

Security Affairs

SEPTEMBER 25, 2023

Sonar’s Vulnerability Research Team discovered a critical security vulnerability, tracked as CVE-2023-42793 (CVSS score of 9.8), in TeamCity. The vulnerability is an authentication bypass issue affecting the on-premises version of TeamCity. ” The link for the Security patch plugin are for TeamCity 2018.2

Hacking 138

Hacking Software Authentication Internet 138

Security Affairs

AUGUST 21, 2023

Ivanti warned customers of a new critical Sentry API authentication bypass vulnerability tracked as CVE-2023-38035. The software company Ivanti released urgent security patches to address a critical-severity vulnerability, tracked as CVE-2023-38035 (CVSS score 9.8), in the Ivanti Sentry (formerly MobileIron Sentry) product.

Authentication 98

Authentication Internet Internet Mobile 98

Security Affairs

DECEMBER 19, 2020

The two techniques reported in the NSA’s advisory are related to the possibility to forge Security Assertion Markup Language (SAML) tokens used single sign-on (SSO) authentication processes. Using the private keys, the actors then forge trusted authentication tokens to access cloud resources.” ” continues the alert.

Authentication 145

Authentication Hacking Government Accountability 145

Security Affairs

NOVEMBER 25, 2023

The Rhysida ransomware group claimed to have hacked the Chinese state-owned energy conglomerate China Energy Engineering Corporation. The group relied on compromised credentials to authenticate to internal VPN access points. Energy China [link] TL;DR That's huuuge! Rhysida actors leverage external-facing remote services (e.g.

Ransomware 143

Ransomware Hacking Engineering Manufacturing 143

Security Affairs

DECEMBER 2, 2022

CyRC experts warn of weak or missing authentication mechanisms, missing authorization, and insecure communication vulnerabilities in the three apps. “An exploit of the authentication and authorization vulnerabilities could allow remote unauthenticated attackers to execute arbitrary commands. . Pierluigi Paganini.

Hacking 145

Hacking Authentication Mobile Passwords 145

Security Affairs

FEBRUARY 18, 2023

Twitter has announced that the platform will allow using the SMS-based two-factor authentication (2FA) only to its Blue subscribers. To date, Twitter has offered three methods of 2FA : text message, authentication app, and security key. ” reads the post published by the social media and social networking service.

Authentication 98

Authentication Accountability Media Hacking 98

Security Affairs

FEBRUARY 27, 2021

A critical authentication bypass vulnerability could be exploited by remote attackers to Rockwell Automation programmable logic controllers (PLCs). “An attacker who is able to extract the secret key would be able to authenticate to any Rockwell Logix controller.” SecurityAffairs – hacking, PLC). Pierluigi Paganini.

Authentication 136

Authentication Software Engineering Manufacturing 136

SecureList

AUGUST 14, 2023

Another tactic, popular with scammers big and small, phishers included, is hacking websites and placing malicious content on those, rather than registering new domains. Besides tucking a phishing page inside the website they hack, scammers can steal all of the data on the server and completely disrupt the site’s operation.

Phishing 81

Phishing Hacking Banking Scams 81

Security Affairs

NOVEMBER 27, 2023

Ukraine’s intelligence service announced the hack of the Russian Federal Air Transport Agency, ‘Rosaviatsia.’ ’ Ukraine’s intelligence service announced they have hacked Russia’s Federal Air Transport Agency, ‘Rosaviatsia.’ ” reads the announcement. ” reads the announcement.

Hacking 140

Hacking Engineering Government Manufacturing 140

Security Affairs

NOVEMBER 2, 2023

The attacks targeted IT service desk staff to trick them into resetting all multi-factor authentication (MFA) factors enrolled by highly privileged users. In December 2022, the American identity and access management giant revealed that its private GitHub repositories were hacked.

Data breaches 141

Data breaches Hacking Healthcare Social Engineering 141

Security Affairs

NOVEMBER 29, 2023

The Rhysida ransomware group claimed to have hacked King Edward VII’s Hospital in London. The Rhysida ransomware group claimed to have hacked King Edward VII’s Hospital in London and added it to the list of victims on its Tor leak site. The group relied on compromised credentials to authenticate to internal VPN access points.

Ransomware 140

Ransomware Hacking Manufacturing Healthcare 140

Security Affairs

APRIL 8, 2021

The maintainers of the PHP programming language have provided an update regarding the security breach that took place on March 28. Unknown attackers hacked the official Git server of the PHP programming language and pushed unauthorized updates to insert a backdoor into the source code. SecurityAffairs – hacking, data breach).

Hacking 122

Hacking Passwords Authentication Data breaches 122

Security Affairs

NOVEMBER 8, 2022

Citrix released security updates to address a critical authentication bypass vulnerability in Citrix ADC and Citrix Gateway. Citrix is urging customers to install security updates to address a critical authentication bypass issue, tracked as CVE-2022-27510, in Citrix ADC and Citrix Gateway. ” concludes the bulletin.

Authentication 98

Authentication VPN Phishing Hacking 98

Security Affairs

SEPTEMBER 8, 2022

” The fourth issue fixed by the vendor is an authentication bypass flaw, tracked CVE-2022-20923 (CVSS score: 4.0) SecurityAffairs – hacking, NVIDIA). The post Cisco will not fix the authentication bypass flaw in EoL routers appeared first on Security Affairs. Follow me on Twitter: @securityaffairs and Facebook.

Authentication 143

Authentication Small Business Software Firewall 143

Security Affairs

FEBRUARY 3, 2023

Atlassian has released security updates to address a critical vulnerability in Jira Service Management Server and Data Center, tracked as CVE-2023-22501 (CVSS score: 9.4), that could be exploited by an attacker to impersonate another user and gain unauthorized access to other Jira Service Management instances under certain circumstances.

Authentication 98

Authentication Software Hacking Accountability 98

Security Affairs

OCTOBER 7, 2022

Fortinet addressed a critical authentication bypass vulnerability that impacted FortiGate firewalls and FortiProxy web proxies. Fortinet addressed a critical authentication bypass flaw, tracked as CVE-2022-40684, that impacted FortiGate firewalls and FortiProxy web proxies. SecurityAffairs – hacking, authentication bypass).

Authentication 98

Authentication Firewall Hacking Risk 98

Security Affairs

MAY 11, 2023

Industrial and IoT cybersecurity firm Claroty disclosed technical details of five vulnerabilities that be exploited to hack some Netgear router models. “Team82 disclosed five vulnerabilities in NETGEAR’s Nighthawk RAX30 routers as part of its research and participation in last December’s Pwn2Own Toronto hacking competition.”

Hacking 98

Hacking Firmware Authentication DNS 98

Security Affairs

NOVEMBER 24, 2020

Microsoft released an out-of-band update for Windows to address authentication flaws related to a recently patched Kerberos vulnerability. Microsoft released an out-of-band update to address authentication issues in Windows related to a recently patched Kerberos vulnerability tracked as CVE-2020-17049. “An Pierluigi Paganini.

Authentication 138

Authentication Hacking Information Security Malware 138

Security Affairs

MAY 5, 2021

Researchers found a critical vulnerability in HPE Edgeline Infrastructure Manager that could be exploited by a remote attacker to bypass authentication. “A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. . Pierluigi Paganini.

Authentication 133

Authentication Passwords Accountability System Administration 133

Security Affairs

DECEMBER 13, 2022

VMware fixed three flaws in multiple products, including a virtual machine escape issue exploited at the GeekPwn 2022 hacking competition. VMware addressed three vulnerabilities in multiple products, including a virtual machine escape flaw, tracked as CVE-2022-31705, that was exploited at the GeekPwn 2022 hacking competition.

Hacking 137

Hacking Authentication Information Security 137