News Targeted

News

Articles tagged with exploit

Windows CLFS zero-day exploited by ransomware gang

Category: Microsoft|Apr 8, 2025 | Author: Admin

Microsoft says the RansomEXX ransomware gang has been exploiting a high-severity zero-day flaw in the Windows Common Log File System to gain SYSTEM privileges on victims' systems. [more]

Critical auth bypass bug in CrushFTP now exploited in attacks

Category: IT|Apr 1, 2025 | Author: Admin

Attackers are now targeting a critical authentication bypass vulnerability in the CrushFTP file transfer software using exploits based on publicly available proof-of-concept code. [more]

The 4 WordPress flaws hackers targeted the most in Q1 2025

Category: IT|Mar 27, 2025 | Author: Admin

A new report sheds light on the most targeted WordPress plugin vulnerabilities hackers used in the first quarter of 2025 to compromise sites. [more]

Exploits for unpatched Parallels Desktop flaw give root on Macs

Category: IT|Feb 24, 2025 | Author: Admin

Two different exploits for an unpatched Parallels Desktop privilege elevation vulnerability have been publicly disclosed, allowing users to gain root access on impacted Mac devices. [more]

CISA flags Craft CMS code injection flaw as exploited in attacks

Category: IT|Feb 21, 2025 | Author: Admin

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks. [more]

Hackers exploit authentication bypass in Palo Alto Networks PAN-OS

Category: IT|Feb 15, 2025 | Author: Admin

Hackers are launching attacks against Palo Alto Networks PAN-OS firewalls by exploiting a recently fixed vulnerability (CVE-2025-0108) that allows bypassing authentication. [more]

Fortinet warns of FortiWLM bug giving hackers admin privileges

Category: IT|Dec 27, 2024 | Author: Admin

Fortinet has disclosed a critical vulnerability in Fortinet Wireless Manager (FortiWLM) that allows remote attackers to take over devices by executing unauthorized code or commands through specially crafted web requests. [more]

Windows kernel bug now exploited in attacks to gain SYSTEM privileges

Category: Microsoft|Dec 16, 2024 | Author: Admin

CISA has warned U.S. federal agencies to secure their systems against ongoing attacks targeting a high-severity Windows kernel vulnerability. [more]

Cleo patches critical zero-day exploited in data theft attacks

Category: IT|Dec 12, 2024 | Author: Admin

Cleo has released security updates for a zero-day flaw in its LexiCom, VLTransfer, and Harmony software, which is currently exploited in data theft attacks. [more]

Japan warns of IO-Data zero-day router flaws exploited in attacks

Category: IT|Dec 4, 2024 | Author: Admin

Japan's CERT is warning that hackers are exploiting zero-day vulnerabilities in I-O Data router devices to modify device settings, execute commands, or even turn off the firewall. [more]

Microsoft re-releases Exchange updates after fixing mail delivery

Category: Microsoft|Nov 28, 2024 | Author: Admin

Microsoft has re-released the November 2024 security updates for Exchange Server after pulling them earlier this month due to email delivery issues on servers using custom mail flow rules. [more]

Hackers exploit critical bug in Array Networks SSL VPN products

Category: IT|Nov 26, 2024 | Author: Admin

America's cyber defense agency has received evidence of hackers actively exploiting a remote code execution vulnerability in SSL VPN products Array Networks AG and vxAG ArrayOS. [more]

CISA tags Progress Kemp LoadMaster flaw as exploited in attacks

Category: General|Nov 19, 2024 | Author: Admin

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added three new flaws in its Known Exploited Vulnerabilities (KEV) catalog, including a critical OS command injection impacting Progress Kemp LoadMaster. [more]

Massive PSAUX ransomware attack targets 22,000 CyberPanel instances

Category: IT|Nov 5, 2024 | Author: Admin

Article updated to add information from CyberPanel developer and with information on free decryptor. [more]

Lazarus hackers used fake DeFi game to exploit Google Chrome zero-day

Category: Google|Oct 25, 2024 | Author: Admin

The North Korean Lazarus hacking group exploited a Google Chrome zero-day tracked as CVE-2024-4947 through a fake decentralized finance (DeFi) game targeting individuals in the cryptocurrency space. [more]

Over 6,000 WordPress hacked to install plugins pushing infostealers

Category: IT|Oct 23, 2024 | Author: Admin

WordPress sites are being hacked to install malicious plugins that display fake software updates and errors to push information-stealing malware. [more]

SolarWinds Web Help Desk flaw is now exploited in attacks

Category: IT|Oct 22, 2024 | Author: Admin

CISA has added three flaws to its 'Known Exploited Vulnerabilities' (KEV) catalog, among which is a critical hardcoded credentials flaw in SolarWinds Web Help Desk (WHD) that the vendor fixed in late August 2024. [more]

Critical Ivanti vTM auth bypass bug now exploited in attacks

Category: IT|Sep 24, 2024 | Author: Admin

CISA has tagged another critical Ivanti security vulnerability, which can let threat actors create rogue admin users on vulnerable Virtual Traffic Manager (vTM) appliances, as actively exploited in attacks. [more]

Ivanti warns of critical vTM auth bypass with public exploit

Category: IT|Aug 13, 2024 | Author: Admin

Today, Ivanti urged customers to patch a critical authentication bypass vulnerability impacting Virtual Traffic Manager (vTM) appliances that can let attackers create rogue administrator accounts. [more]

This Windows 11 Wi-Fi vulnerability shows the importance of keeping your PC up to date

Category: Microsoft|Jun 25, 2024 | Author: Admin

Microsoft has recently confirmed the existence of CVE-2024-30078, which is a new Wi-Fi takeover attack that could allow malicious users to inject malware onto a Windows PC or laptop remotely. This vulnerability wasn't originally publicly disclosed and is now patched with an up-to-date... [more]

Exploit released for Fortra GoAnywhere MFT auth bypass bug

Category: IT|Jan 25, 2024 | Author: Admin

Exploit code is now available for a critical authentication bypass vulnerability in Fortra's GoAnywhere MFT (Managed File Transfer) software that allows attackers to create new admin users on unpatched instances via the administration portal. [more]