IT-Sicherheitsupdates | Stinner IT Solutions

XZ Utils Supply Chain Attack (CVE-2024-3094)

von | 2. Apr. 2024 | Unkategorisiert

What is the vulnerability/attack? A malicious code was discovered embedded in the XZ Utils which is a data compression software included in major Linux distributions. This vulnerability tracked under CVE-2024-3094 is a result of a supply chain attack on the versions...

Adobe ColdFusion Access Control Bypass (CVE-2023-26347, CVE-2023-38205)

von | 30. März 2024 | Unkategorisiert

What is the vulnerability? The Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by Improper Access Control vulnerabilities that could result in a security bypass. Exploitation of these vulnerabilities could give attacker access to...

Apache OFBiz Authentication Bypass (CVE-2023-51467, CVE-2023-49070)

von | 30. März 2024 | Unkategorisiert

What is the vulnerability? There is an authentication bypass vulnerability in Apache OFBiz tracked under CVE-2023-51467 and CVE-2023-49070. Successful exploitation would let an attacker circumvent authentication processes, enabling them to remotely execute arbitrary...

Atlassian Confluence Remote Code Execution (CVE-2023-22527)

von | 30. März 2024 | Unkategorisiert

What is the Vulnerability? On Jan 16 2024, Atlassian released an advisory for a template injection vulnerability on Confluence Data Center and Server. That can allow an unauthenticated attacker to remotely execute malicious code on affected versions. This...

Ivanti Connect Secure and Policy Secure Gateways Zero-day Vulnerabilities (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893)

von | 30. März 2024 | Unkategorisiert

What is the Vulnerability? Ivanti recently published an advisory on two vulnerabilities on Jan 10, 2024 affecting Ivanti Connect Secure (ICS) and Ivanti Policy Secure Gateways (CVE-2023-46805 and CVE-2024-21887). The vulnerabilities are an authentication bypass and...

Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2024-21410)

von | 30. März 2024 | Unkategorisiert

What is the Vulnerability? Microsoft disclosed a critical security flaw in the Exchange Server. Tracked as CVE-2024-21410, the issue has been described as a privilege escalation vulnerability. This security flaw can let remote unauthenticated threat actors escalate...

ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)

von | 30. März 2024 | Unkategorisiert

What is the Vulnerability? On February 19, 2024, ConnectWise published a security advisory for their remote desktop application software called ScreenConnect. One of the flaws, CVE-2024-1709 is an authentication bypass vulnerability that could let attackers gain...

JetBrains TeamCity Authentication Bypass Vulnerabilities (CVE-2024-27198, CVE-2024-27199)

von | 30. März 2024 | Unkategorisiert

What are the Vulnerabilities? Two new vulnerabilities affecting JetBrains TeamCity CI/CD server have been identified and tagged as CVE-2024-27198 and CVE-2024-27199. The most severe of the two, CVE-2024-27198, has been added to CISA’s known exploited catalog...

Kimsuky Malware Attack

von | 30. März 2024 | Unkategorisiert

What is the Kimsuky Malware Attack? Kimsuky, officially known as the Kim Suky Group, is a cyber-espionage group linked to North Korea. The group has been active since at least 2012 and is primarily focused on gathering intelligence targeting South Korean government...

Jenkins Arbitrary File Read Vulnerability (CVE-2024-23897)

von | 30. März 2024 | Unkategorisiert

What is the Vulnerability? Cyber threat actors are actively targeting Jenkins, a Java-based open-source automation server widely used by application developers. The critical vulnerability tracked as CVE-2024-23897 could enable remote code execution (RCE) potentially...

« Ältere Einträge

Nächste Einträge »