vulnerability

Fortinet has disclosed an actively exploited critical vulnerability, CVE-2024-47575, impacting FortiManager and FortiAnalyzer devices, which has been attributed to threat cluster UNC5820. This flaw, labeled FortiJump, enables remote unauthenticated attackers to execute arbitrary code on compromised systems, allowing for data exfiltration and potential lateral movement across enterprise networks. The U.S. CISA has flagged this vulnerability for immediate federal agency action, urging rapid patching to prevent unauthorized access and data theft.

A recently discovered phishing campaign is exploiting a stored cross-site scripting (XSS) vulnerability in the open-source Roundcube webmail software to steal login credentials. Threat actors are leveraging a now-patched flaw (CVE-2024-37383) via malicious emails, targeting government organizations in Commonwealth of Independent States (CIS) countries. The vulnerability, patched in May 2024, allowed attackers to execute JavaScript within victims' browsers, tricking them into revealing sensitive login information.

Threat actors are exploiting a now-patched vulnerability in Veeam Backup & Replication (CVE-2024-40711) to deploy Akira and Fog ransomware. Using compromised VPN credentials, attackers create local accounts and spread ransomware, targeting enterprise backup systems. The flaw, rated 9.8 on the CVSS scale, enables remote code execution and was patched in September 2024.

A critical security vulnerability in Firefox and Firefox Extended Support Release (ESR) is actively being exploited in the wild. The flaw, tracked as CVE-2024-9680, has a high severity rating (CVSS 9.8) and allows attackers to execute remote code. Mozilla has issued an urgent advisory urging users to update their browsers immediately to safeguard against potential attacks.

A new cybersecurity threat, dubbed CosmicSting, is wreaking havoc on Adobe Commerce and Magento stores. Exploiting a critical vulnerability (CVE-2024-34102), attackers are using remote code execution to infiltrate e-commerce platforms, steal sensitive data, and compromise entire systems.

The recent news of hackers using OTP APIs for SMS bombing and 44 Indian APIs being exposed is a matter

Microsoft is looking into a persistent Exchange Online outage that prevents users from sending emails and results in 503 errors

With over 1.5 million installations combined, two malicious file management apps were identified by security experts on Google Play. These

Security researchers have discovered a straightforward method to introduce malware to a Microsoft Teams-using organization, despite the application’s

Since April 2023, a brand-new information-stealing malware known as “Mystic Stealer” has been advertised on hacking forums and darknet markets,