Browsing Tag
vulnerability
29 posts
Log4j New Year Wrap-Up
One month into the Log4j vulnerability, we take a look at the 3 CVEs and their fixes, known exploits being observed in the wild, and a way forward in dealing with the ubiquitous and targeted Java library.
Apache Releases Log4j 2.16.0 to Patch Lingering DoS Vulnerability
Amid the focus on Log4j while patching CVE-2021-44228, a JNDI injection RCE vulnerability, Apache has released 2.16.0 which disables JNDI by default and removes support for Message lookups in order to fix a newly discovered denial of service vulnerability.
Log4j/Log4Shell Updates and Recommended Guidance
Updates and recommended guidance for identifying vulnerable servers and mitigating exploit attempts.
Apache Log4j Zero-Day Exposes Java Applications to RCE
A high-severity zero-day has been uncovered in Apache Log4j which could allow a log injection RCE exploit.
Multiple Vulnerabilities Discovered in Zoom Client
Two new vulnerabilities discovered in Zoom Client for Meetings allow arbitrary code execution and exposed process memory. Updates…
Critical RCE Vulnerability in Palo Alto Global Protect Firewall Affects Estimated 10,000 VPNs
Randori, a red team cybersecurity company, officially disclosed a zero-day memory corruption vulnerability within the Palo Alto Global…
Oracle releases October Critical Patch Update for all product lines
Urgent action is required to apply the critical patch updates, as Oracle products are everywhere and threat actors…
Apple Releases Updates to Actively Exploited iOS and iPadOS Vulnerability
The vulnerability allows for arbitrary code execution at kernel level permissions and appears to be actively leveraged by…
GitLab Security Updates Patch Dozens of Newly Disclosed Vulnerabilities
Multiple high-rated Cross-Site Scripting (XSS) vulnerabilities that allow for arbitrary JavaScript Execution are among the many vulnerabilities patched…
Hikvision Cameras RCE Vulnerability Requires a Firmware Update
On September 19, 2021, Hikvision released a security advisory (CVE-2021-36260) regarding an unauthenticated remote code execution vulnerability reported…