Security Affairs

OCTOBER 17, 2024

The vulnerability is an authenticated SQL injection vulnerability in HCX, it was privately reported to VMware by Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) through the Trend Micro Zero Day Initiative (ZDI). “An authenticated SQL injection vulnerability in HCX was privately reported to VMware.

Authentication 130

Authentication Mobile Hacking Information Security 130

Krebs on Security

OCTOBER 30, 2024

The chief information security officer for a large academic healthcare system affected by the breach told KrebsOnSecurity they participated in a call with the FBI and were told a third party partner managed to recover at least four terabytes of data that was exfiltrated from Change by the cybercriminal group. .”

Healthcare 300

Healthcare Insurance Computers and Electronics Data breaches 300

Security Affairs

OCTOBER 20, 2024

An authenticated attacker, with Manager role privileges or higher, could exploit the vulnerability CVE-2024-45844 to elevate privileges and compromise the BIG-IP system. “An authenticated attacker may exploit this vulnerability by storing malicious HTML or JavaScript code in the BIG-IQ user interface.

Authentication 136

Authentication Hacking Technology Information Security 136

Security Affairs

FEBRUARY 24, 2025

A botnet of 130,000+ devices is attacking Microsoft 365 accounts via password-spraying, bypassing MFA by exploiting basic authentication. The attackers targeted accounts protected with basic authentication bypassing multi-factor authentication. Despite Microsoft phasing it out, it remains an active security risk.

Passwords 119

Passwords Accountability Authentication Malware 119

Security Affairs

FEBRUARY 20, 2025

The company pointed out that only authenticated users with existing access to the NetScaler Console can exploit this vulnerability. “The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization. NetScaler Console 14.1

Authentication 117

Authentication Software Hacking Information Security 117

Security Affairs

MAY 22, 2024

A critical security vulnerability in Veeam Backup Enterprise Manager could allow threat actors to bypass authentication. A critical vulnerability, tracked as CVE-2024-29849 (CVSS score: 9.8), in Veeam Backup Enterprise Manager could allow attackers to bypass authentication.

Backups 129

Backups Authentication Accountability Software 129

Security Affairs

MARCH 30, 2025

The vulnerability Ivanti impacted Ivanti Connect Secure, Policy Secure and ZTA Gateways. A local authenticated attacker can trigger the vulnerability to escalate privileges. Ivanti has released an update that addresses one critical and one high vulnerability in Ivanti Connect Secure, Policy Secure and ZTA Gateways.

Malware 120

Malware Authentication Cybersecurity Encryption 120

Security Affairs

OCTOBER 21, 2024

The Internet Archive was breached again, attackers hacked its Zendesk email support platform through stolen GitLab authentication tokens. Internet Archive Zendesk emails sent by the threat actor Source: BleepingComputer The message highlights a poor security posture by the Internet Archive.

Internet 127

Internet Internet Data breaches Authentication 127

Security Affairs

JUNE 16, 2024

Taiwanese manufacturer giant ASUS addressed a critical remote authentication bypass vulnerability impacting several router models. ASUS addresses a critical remote authentication bypass vulnerability, tracked as CVE-2024-3080 (CVSS v3.1 score: 9.8), impacting seven router models. impacting multiple devices.

Authentication 129

Authentication Firmware VPN Manufacturing 129

Security Affairs

APRIL 1, 2025

Threat actors are exploiting a critical authentication bypass vulnerability, tracked as CVE-2025-2825 , in the CrushFTP file transfer software. that may allow unauthenticated remote attackers to bypass authentication via HTTP(S) requests. Attackers are using exploits based on publicly available proof-of-concept exploit code.

Authentication 117

Authentication Software Ransomware Hacking 117

Security Affairs

NOVEMBER 7, 2024

CVE-2024-43093 CVE-2024-43047″ reads the security bulletin published by Google. Additionally, Expedition provides automation and best practice adoption to improve security posture and operational efficiency. The vulnerability is a privilege escalation issue in the Android Framework component. Versions up to 2.3.6 and unpatched 2.3.7

Firewall 124

Firewall Authentication Accountability Risk 124

Security Affairs

NOVEMBER 13, 2024

is a buffer overflow issue that an authenticated attacker could exploit. “Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.” is an improper input validation issue that can be exploited remotely without authentication.

Authentication 114

Authentication Mobile Hacking Information Security 114

Security Affairs

FEBRUARY 16, 2025

” Device code phishing attacks exploit authentication flows to steal tokens, granting attackers access to accounts and data. Upon clicking the meeting invitation embedded in the message, recipients are prompted to authenticate using a threat actor-generated device code. ” continues the report.

Phishing 113

Phishing Authentication Telecommunications Accountability 113

Security Affairs

MARCH 18, 2025

The vulnerability is an authentication bypass issue that could allow a remote attacker to gain super-admin privileges by making maliciously crafted CSF proxy requests. An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0

Authentication 114

Authentication Ransomware Firewall Hacking 114

Security Affairs

DECEMBER 11, 2024

Ivanti addressed a critical authentication bypass vulnerability impacting its Cloud Services Appliance (CSA) solution. Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-11639 (CVSS score of 10), in its Cloud Services Appliance (CSA) solution. ” reads the advisory published by the company.

Authentication 105

Authentication Software Hacking Information Security 105

Security Affairs

FEBRUARY 19, 2025

The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user. Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025.

Firewall 104

Firewall Authentication Architecture Internet 104

Security Affairs

OCTOBER 19, 2024

Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Overlapping indicators link these cases to prior Fog and Akira ransomware attacks.

Backups 129

Backups VPN Ransomware Authentication 129

Security Affairs

OCTOBER 23, 2024

Cybersecurity and Infrastructure Security Agency (CISA) added the Fortinet FortiManager missing authentication vulnerability CVE-2024-47575 (CVSS v4 score: 9.8) A missing authentication flaw in FortiManager and FortiManager Cloud versions allows attackers to execute arbitrary code or commands through specially crafted requests.

Authentication 124

Authentication Malware Risk Cybersecurity 124

Security Affairs

FEBRUARY 15, 2025

. “Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted andtake immediate steps to secure them.“ An unauthenticated attacker on the network couple exploit the vulnerability to bypass authentication and invoke certain PHP scripts. ” reads the report published by Assetnote.

Firewall 100

Firewall Authentication Architecture Risk 100

Security Affairs

NOVEMBER 26, 2024

Attackers can exploit the SSL VPN gateway by accessing the filesystem via an HTTP header flags attribute and a vulnerable URL without authentication. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. ” reads the advisory.

VPN 110

VPN Authentication Hacking Cybersecurity 110

Security Affairs

JANUARY 8, 2025

SonicWall warns customers to address an authentication bypass vulnerability in its firewall’s SonicOS that is “susceptible to actual exploitation.” The vulnerability resides in SSL VPN and SSH management and according to the vendor is “susceptible to actual exploitation.”

Firewall 113

Firewall Firmware VPN Authentication 113

Security Affairs

FEBRUARY 19, 2025

The second vulnerability, tracked CVE-2025-26466 (CVSS score: 5.9), affects both the OpenSSH client and server, allowing a pre-authentication denial-of-service attack. ” The OpenSSH client and server are vulnerable (CVE-2025-26466) to a pre-authentication denial-of-service (DoS) attack.

Authentication 121

Authentication System Administration DNS Hacking 121

Security Affairs

NOVEMBER 8, 2024

Cybersecurity and Infrastructure Security Agency (CISA) added a Palo Alto Expedition Missing Authentication Vulnerability, tracked as CVE-2024-5910 , to its Known Exploited Vulnerabilities (KEV) catalog.

Firewall 115

Firewall Authentication Internet Internet 115

Krebs on Security

APRIL 27, 2023

Customers can access a Salesforce Community website in two ways: Authenticated access (requiring login), and guest user access (no login required). This misconfigured Salesforce Community site from the state of Vermont was leaking pandemic assistance loan application data, including names, SSNs, email address and bank account information.

Banking 346

Banking Government Information Security Authentication 346

The Last Watchdog

DECEMBER 5, 2024

5, 2024, CyberNewswire — One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management (PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the industrys leading information security magazine. Alisa Viejo, Calif.,

InfoSec 130

InfoSec Cyber Risk CISO Cybersecurity 130

Security Affairs

JANUARY 16, 2025

Over the years, multiple security experts have identified several vulnerabilities in MikroTik routers, such as a remote code execution vulnerability detailed by VulnCheck researchers here. The botnet’s SOCKS proxy setup enables access for hundreds of thousands of compromised machines. ” reads the report published by Infoblox.

DNS 138

DNS Malware Firmware Authentication 138

Security Affairs

FEBRUARY 18, 2025

Juniper Networks addressed a critical authentication bypass vulnerability, tracked as CVE-2025-21589 (CVSS score of 9.8), affecting its Session Smart Router product. The company discovered the vulnerability during internal product security testing or research. ” reads the advisory.

Authentication 83

Authentication Hacking Information Security 83

Security Affairs

JANUARY 30, 2025

.” The researchers noted that the leak could have allowed attackers to take full control of the database and potentially escalate privileges within the DeepSeek environment, without any authentication. The experts used ClickHouses HTTP interface and accessed the /play path to execute arbitrary SQL queriesvia the browser.

Authentication 119

Authentication Passwords Hacking Risk 119

Security Affairs

OCTOBER 12, 2024

Since April 2021, Russian state-sponsored hackers have exploited vulnerabilities, including Zimbra’s CVE-2022-27924 for injecting commands to access credentials and emails, and JetBrains TeamCity’s CVE-2023-42793 for arbitrary code execution through an authentication bypass.

Data collection 135

Data collection Authentication Hacking Government 135

Security Affairs

DECEMBER 6, 2024

Cybersecurity and Infrastructure Security Agency (CISA)added the CyberPanelflaw CVE-2024-51378 (CVSS score: 10.0) Remote attackers could bypass authentication and execute arbitrary commands by exploiting a flaw in secMiddleware , which only validates POST requests. to its Known Exploited Vulnerabilities (KEV) catalog. and ftp/views.py.

DNS 108

DNS Authentication Ransomware Hacking 108

Security Affairs

FEBRUARY 4, 2025

The two flaws are, respectively, a remote code execution issue and an authentication bypass vulnerability. The unauthenticated RCE security vulnerability PSV-2023-0039 impacts the following product models: XR1000, the issue was fixed in firmware version 1.0.0.74 XR1000v2, the issue was fixed in firmware version 1.1.0.22

Firmware 107

Firmware Authentication Hacking Information Security 107

Security Affairs

NOVEMBER 17, 2024

The Really Simple Security plugin, formerly Really Simple SSL, is a popular WordPress tool that enhances website security with features like login protection, vulnerability detection, and two-factor authentication. Wordfence’s researcher István Márton discovered the vulnerability on November 6, 2024. and up to 9.1.1.1

Authentication 73

Authentication Accountability Hacking Information Security 73

Security Affairs

NOVEMBER 29, 2024

Phishing tool Rockstar 2FA targets Microsoft 365 credentials, it uses adversary-in-the-middle (AitM) attacks to bypass multi-factor authentication. Rockstar 2FA targets Microsoft 365 accounts and bypasses multi-factor authentication with adversary-in-the-middle (AitM) attacks.

Phishing 112

Phishing Accountability Authentication Advertising 112

Security Affairs

JANUARY 31, 2025

In October 2024, VMware warned customers of the availability of a proof-of-concept (PoC) exploit code for another authentication bypass vulnerability, tracked as CVE-2023-34051 , in VMware Aria Operations for Logs (formerly known as vRealize Log Insight). is an authentication bypass vulnerability in VMware Aria Operations for Logs.

Authentication 105

Authentication Hacking Cybersecurity Information Security 105

Security Affairs

DECEMBER 19, 2024

.” The experts added that FortiWLM’s verbose logs expose session IDs, enabling attackers to exploit log file read vulnerabilities to hijack sessions and access authenticated endpoints. Authenticated users’ session ID tokens in FortiWLM remain static per device boot.

Wireless 104

Wireless Authentication Healthcare Education 104

SecureWorld News

DECEMBER 12, 2024

Trey Ford, Chief Information Security Officer at Bugcrowd, observed, "This incident may not have been made public if it wasn't for the Form 8-K requirement." Strong Password Management: Enforce strong, unique passwords and multi-factor authentication to protect against unauthorized access.

Password Management 108

Password Management Passwords CISO Cybersecurity 108

Security Affairs

NOVEMBER 15, 2024

Glove Stealer is a.NET-based information stealer that targets browser extensions and locally installed software to steal sensitive data. The malware could harvest a huge trove of data from infected systems, including cookies, autofill, cryptocurrency wallets, 2FA authenticators, password managers, and email client information.

Encryption 115

Encryption Password Management Cryptocurrency Social Engineering 115