Current Security Vulnerability Reports

Access all Security Vulnerability Reports on the Archive page.

20/02/2025

CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface

An authentication bypass in the Palo Alto Networks PAN-OS software by the PAN-OS management web interface and invoke certain PHP scripts.

15/01/2025

Fortinet Warns of Auth Bypass Zero-day Exploited to Hijack Firewalls

Attackers are exploiting a new authentication bypass zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks.

11/12/2024

Windows LDAP Remote Code Execution Vulnerability

CVE-2024-49112 is a Critical RCE vulnerability affecting the Windows LDAP Client with a CVSS score of 9.8.

06/12/2024

SQL injection in Zabbix user.get API

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.

18/11/2024

PAN-OS: Authentication Bypass in the Management Web Interface

Missing authentication for critical function in the FortiManager fgfmd daemon [CWE-306] vulnerability could allow a remote unauthenticated attacker to execute arbitrary code or commands through specially crafted requests.

17/09/2024

SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks

SolarWinds has released fixes to address two security flaws in its Access Rights Manager (ARM) software, including a critical vulnerability that could result in remote code execution.

01/07/2024

Remote Unauthenticated Code Execution Vulnerability in OpenSSH server

Race condition in sshd(8) A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges.

10/05/2024

Google Zero Day Vulnerability Created

Google on Thursday released security updates to address a zero-day flaw in Chrome that it said has been actively exploited in the wild.

08/05/2024

Veeam RCE Vulnerability Exposes Data Protection Services to Risk Created

Veeam, a leading provider of backup and data protection solutions, has released a security advisory concerning a critical remote code execution (RCE) vulnerability in its Service Provider Console.

25/04/2024

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely Created

The node-mysql2 library, a popular JavaScript tool used for database connections with over 2 million installations weekly, has been identified with three critical security flaws:

24/04/2024

Google Patches Critical Chrome Vulnerability Created

Google recently announced a Chrome update to version 124, addressing four security vulnerabilities, with the most severe being a critical type confusion bug in the ANGLE graphics layer engine, designated as CVE-2024-4058.

17/04/2024

PuTTY SSH Client Found Vulnerable to Key Recovery Attack Created

PuTTY, a widely-used SSH client, has been found vulnerable to a critical flaw that could lead to the recovery of NIST P-521 private keys.

07/04/2024

Linux Systems Under Threat: Mitigating CVE-2024-1086 Created

A critical security vulnerability, CVE-2024-1086, has emerged, targeting Linux kernels from version 5.14 to 6.6, affecting distributions such as Debian, Ubuntu, and KernelCTF.

01/04/2024

Addressing the CVE-2024-3094 Vulnerability in XZ Utils Across Linux Distributions Created

A critical security vulnerability, designated as CVE-2024-3094, has been identified in the XZ Utils compression tools widely utilized across various Linux distributions in recent days.

07/03/2024

VMware Releases Critical Security Patches for ESXi, Workstation, and Fusion Vulnerabilities Created

VMware has issued critical security patches to address four vulnerabilities affecting its ESXi, Workstation, and Fusion products.

07/03/2024

Apple Releases Urgent Updates to Address Actively Exploited Zero-Day Vulnerabilities Created

Apple has swiftly responded to critical security concerns by releasing urgent updates to rectify two actively exploited zero-day vulnerabilities.

22/02/2024

VMware Security Vulnerabilities

VMware urged admins today to remove a discontinued authentication plugin exposed to authentication relay and session hijack attacks in Windows domain environments via two security vulnerabilities left unpatched.

15/02/2024

Adobe Security Vulnerabilities

Adobe Framemaker versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass.

14/02/2024

Microsoft Outlook Vulnerability

It is a Remote Code Execution (RCE) vulnerability in Microsoft Outlook, which is expected to occur in Outlook 2016 until 2021 (see CVE-2024-21413).

03/02/2024

AnyDesk Security Breach

AnyDesk, a popular remote access solution, recently confirmed that it experienced a cyberattack on its production systems, resulting in unauthorized access.

31/01/2024

Microsoft Edge Vulnerability

A significant vulnerability in Microsoft Edge (Chromium-based) has been identified, designated as CVE-2024-21326.

22/01/2024

Ivanty Vulnerability

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

16/01/2024

Critical RCE Flaw in Confluence Data Center and Server Created

A critical security vulnerability has been identified in Confluence Data Center and Confluence Server, known as CVE-2023-22527.

13/10/2023

Samba Security Update

A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory.

31/10/2023

Improper Authorization Vulnerability In Confluence Data Center and Server

As part of Atlassian's ongoing monitoring of this CVE, we observed publicly posted critical information about the vulnerability which increases risk of exploitation.

10/10/2023

Windows IIS Server Elevation of Privilege Vulnerability

CVE-2023-36434 is an EoP vulnerability in Windows IIS server that was assigned a CVSSv3 score of 9.8 and rated as important.

10/10/2023

Microsoft Message Queuing Remote Code Execution Vulnerability

CVE-2023-35349 is Critical remote code execution (RCE) vulnerabilities affecting Microsoft Message Queuing (MSMQ), and a CVSS score of 9.8.

09/10/2023

Firefox Vulnerability

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.

03/10/2023

Apple Remote Code Execution Vulnerability

This issue was addressed with improved checks.

18/09/2023

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

On September 18, 2023, the Microsoft Edge Elevation of Privilege Vulnerability vulnerability was released.

08/07/2023

Firefox Arbitrary Code Execution Vulnerability

According to the vulnerability report that has been released on 08th of April; presence of memory safety bugs in Firefox 115 is causing memory corruption.

25/07/2023

Apache Shiro Path Traversal Vulnerability

According to the vulnerability report that has been released on 25th of July; A critical vulnerability has been identified in Apache Shiro which can result in an authentication bypass, potentially putting sensitive data at risk.

22/07/2023

Open SSH Remote Code Execution Vulnerability

According to the vulnerability report that has been released on 22nd of July; a now-patched flaw in OpenSSH that could be potentially exploited in order to run arbitrary commands remotely on compromised hosts under specific conditions.

20/07/2023

Adobe Deserialization of Untrusted Data Vulnerability

According to the vulnerability report released on 20th of July; Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability which could result in Arbitrary code execution.

11/07/2023

Microsoft General Update Vulnerabilities

On 11th of July, Microsoft has released a report for the following vulnerabilities.

10/07/2023

Linux UniFi Malicious Commands Vulnerability

According to the vulnerability report that has been released on 10th of July; a backup file vulnerability was found in UniFi version applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.

10/07/2023

RXVT Unicode Package Remote Code Execution Vulnerability

According to the vulnerability report released on 10th of July; the rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.

07/07/2023

Cisco Traffic Encryption Break Vulnerability

On the July 07 dated vulnerability report released by Cisco, customers warned of a high-severity vulnerability impacting some data center switch models and allowing attackers to tamper with encrypted traffic.

03/07/2023

GitHub SSRF Vulnerability

03 Temmuz 2023 tarihinde GitHub repository plantuml/plantuml 1.2023.9. öncesi sürümleri için bir Sunucu isteği sahteciliği zafiyet duyurusu yayınlandı.

02/07/2023

Google Chrome Mojo Heap Corruption Vulnerability

According to the vulnerability report released on 02n of July; out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

29/06/2023

Windows Livebook Arbitrary Code Execution Vulnerability

Livebook is a web application for writing interactive and collaborative code notebooks.

28/06/2023

Linux Memory Corruption Vulnerability

A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. according to the vulnerability report that has been released on 28th of June.

28/06/2023

Apache Accumulo Improper Authentication Vulnerability

Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo has been released.

28/06/2023

Vmware Use-After-Free Vulnerability

It has been released that there is a use-after-free vulnerability in VMware vCenter Server in the implementation of the DCERPC protocol.

27/06/2023

Windows Thunderbird - Firefox Vulnerability

According to the vulnerability report which has been released on 27th of June; a newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download.

27/06/2023

Microsoft Azure Code Injection Vulnerability

Azure CLI is the command-line interface for Microsoft Azure.

27/06/2023

Windows Environment Variables Vulnerability

According to the vulnerability that has been released on 27th of June; attackers may maliciosly set environment variables on Windows due to unsanitized NUL values.

21/06/2023

HP Device Manager Command Injection Vulnerability

According to the vulnerability that has been released on June 20, HP Device Manager (prior to HPDM 5.0.10) could potentially allow to a command injection and/or elevation of privileges

21/06/2023

Google Chrome Autofill Payments Use After Free Vulnerability

Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allows a remote attacker to exploit heap corruption via a crafted HTML page. Chromium security severity is classified as critical for this vulnerability

21/06/2023

GitHub Code Injection Vulnerability

On June 21, a Code Injection vulnerability for GitHub repository nuxt/nuxt prior to 3.5.3. has been released.

15/06/2023

Adobe Commerce Neutralization of Special ElementsVulnerability

On June 15, Adobe released that Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability which may lead to arbitrary code execution by an admin-privilege authenticated attacker.

15/06/2023

Adobe Animate Arbitrary Code ExecutionVulnerability

On June 15, 2023 Adobe released a use-after-free vulnerability for the Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier).

15/06/2023

GitHub Repository Froxlor Improper Restriction of Excessive Authentication Attempts Vulnerability

On June 15, 2023 an Improper Restriction of Excessive Authentication Attempt vulnerability for GitHub repository froxlor/froxlor prior to 2.0.20. has been released.

15/06/2023