New Patch Released for Actively Exploited 0-Day Apache Path Traversal to RCE Attacks – Tempemail

The Apache Software Foundation on Thursday released additional security updates for its HTTP Server product to remediate what it says is an “incomplete fix” for an actively exploited path traversal and remote code execution flaw that it patched earlier this week. CVE-2021-42013, as the new vulnerability is identified as, builds Continue Reading

Update Google Chrome ASAP to Patch 2 New Actively Exploited Zero-Day Flaws – Tempemail

Google on Thursday pushed urgent security fixes for its Chrome browser, including a pair of two new security weaknesses that the company said are being exploited in the wild, making them the fourth and fifth actively zero-days plugged this month alone. The issues, designed as CVE-2021-37975 and CVE-2021-37976, are part Continue Reading

Urgent Chrome Update Released to Patch Actively Exploited Zero-Day Vulnerability – Tempemail

Google on Friday rolled out an emergency security patch to its Chrome web browser to address a security flaw that’s known to have an exploit in the wild. Tracked as CVE-2021-37973, the vulnerability has been described as use after free in Portals API, a web page navigation system that enables Continue Reading

Urgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-Days – Tempemail

Apple on Thursday released security updates to fix multiple security vulnerabilities in older versions of iOS and macOS that it says have been detected in exploits in the wild, in addition to expanding patches for a previously plugged security weakness abused by NSO Group’s Pegasus surveillance tool to target iPhone Continue Reading

Windows MSHTML 0-Day Exploited to Deploy Cobalt Strike Beacon in Targeted Attacks – Tempemail

Microsoft on Wednesday disclosed details of a targeting phishing campaign that leveraged a now-patched zero-day flaw in its MSHTML platform using specially-crafted Office documents to deploy Cobalt Strike Beacon on compromised Windows systems. “These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed Continue Reading

Microsoft Releases Patch for Actively Exploited Windows Zero-Day Vulnerability – Tempemail

A day after Apple and Google rolled out urgent security updates, Microsoft has pushed software fixes as part of its monthly Patch Tuesday release cycle to plug 66 security holes affecting Windows and other components such as Azure, Office, BitLocker, and Visual Studio, including an actively exploited zero-day in its Continue Reading

CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability – Tempemail

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday issued a bulletin warning of a zero-day flaw affecting Zoho ManageEngine ADSelfService Plus deployments that is currently being actively exploited in the wild. The flaw, tracked as CVE-2021-40539, concerns a REST API authentication bypass that could lead to arbitrary remote Continue Reading

Latest Atlassian Confluence Flaw Exploited to Breach Jenkins Project Server – Tempemail

The maintainers of Jenkins—a popular open-source automation server software—have disclosed a security breach after unidentified threat actors gained access to one of their servers by exploiting a recently disclosed vulnerability in Atlassian Confluence service to install a cryptocurrency miner. The “successful attack,” which is believed to have occurred last week, Continue Reading

Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems – Tempemail

Close to 14 million Linux-based systems are directly exposed to the Internet, making them a lucrative target for an array of real-world attacks that could result in the deployment of malicious web shells, coin miners, ransomware, and other trojans. That’s according to an in-depth look at the Linux threat landscape Continue Reading

Microsoft Releases Windows Updates to Patch Actively Exploited Vulnerability – Tempemail

Microsoft on Tuesday rolled out security updates to address a total of 44 security issues affecting its software products and services, one of which it says is an actively exploited zero-day in the wild. The update, which is the smallest release since December 2019, squashes seven Critical and 37 Important Continue Reading