Critical

Vulnerabilities

Critical 9.8CVE-2023-32560

Critical Buffer Overflow Flaws in Ivanti Avalanche

Unauthenticated stack buffer overflows in Ivanti Avalanche 6.4.0 (CVE-2023-32560, CVSS 9.8) can lead to remote code execution. Update to 6.4.1.

Comments Off on Critical Buffer Overflow Flaws in Ivanti Avalanche

August 16, 2023

Vulnerabilities

Critical 9.8KEVCVE-2022-24086

Hackers Exploit Critical Magento 2 Flaw to Target Online Stores

The Xurum campaign exploits CVE-2022-24086 in Magento 2 to deploy a web shell, create rogue admins and steal payment data.

Comments Off on Hackers Exploit Critical Magento 2 Flaw to Target Online Stores

August 14, 2023

Vulnerabilities

Critical 9.8CVE-2023-38408

OpenSSH Forwarded ssh-agent Flaw Allows Remote Code Execution

CVE-2023-38408 lets an attacker on a server with your forwarded ssh-agent run commands on your workstation. Update OpenSSH to 9.3p2.

Comments Off on OpenSSH Forwarded ssh-agent Flaw Allows Remote Code Execution

July 24, 2023

Vulnerabilities

Critical 9.8KEVCVE-2023-27997

Critical Pre-Auth RCE Flaw in Fortinet FortiGate SSL-VPN (CVE-2023-27997)

A heap overflow in FortiOS SSL-VPN (CVE-2023-27997) allows remote code execution before login. Upgrade to 6.2.15, 6.4.13, 7.0.12 or 7.2.5.

Comments Off on Critical Pre-Auth RCE Flaw in Fortinet FortiGate SSL-VPN (CVE-2023-27997)

June 21, 2023

Vulnerabilities

Critical 9.8CVE-2022-46680 · CVE-2023-1619

Researchers Find Vulnerabilities in Wago and Schneider Electric OT Products

Forescout's OT:ICEFALL research found plaintext credential exposure in Schneider Electric power meters and DoS bugs in Wago 750 controllers.

Comments Off on Researchers Find Vulnerabilities in Wago and Schneider Electric OT Products

June 20, 2023

Vulnerabilities

Critical 9.8KEVCVE-2023-27524

Apache Superset Default Key Flaw Exposes Servers to RCE Attacks

Apache Superset installs that kept the default SECRET_KEY (CVE-2023-27524, now in CISA KEV) let attackers forge admin sessions. Update to 2.1 and set a random key.

Comments Off on Apache Superset Default Key Flaw Exposes Servers to RCE Attacks

April 28, 2023

Security Alerts / Vulnerabilities

Critical 9.8CVE-2023-28121

WooCommerce Payments Plugin Flaw Patched 

A critical flaw in WooCommerce Payments 4.8.0 to 5.6.1 (CVE-2023-28121) let unauthenticated attackers impersonate an admin and take over stores.

Comments Off on WooCommerce Payments Plugin Flaw Patched 

March 25, 2023