Info Security Magazine
3 years, 10 months ago
CISA Expands Vulnerabilities Catalog With Old, Exploited Flaws
Four of the CVEs posted are from 2013, and one is from 2010
Security news aggregator
Latest coverage for Flaw
Stay updated on the latest in information security flaws. Explore news, insights, and analysis on vulnerabilities affecting digital safety.
15
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
A flaw is a defect in software, hardware, system design, or configuration that causes unintended behavior. In security reporting, the term usually means a weakness that could violate confidentiality, integrity, or availability when reached through a particular interface, input, privilege, or operating condition. Not every flaw is exploitable, and exploitability depends on factors such as exposure, authentication requirements, affected versions, and available mitigations.
Flaws matter because they can create attack paths in applications, operating systems, devices, APIs, or administrative settings. Security teams assess their severity and exposure, prioritize remediation, apply patches or configuration changes, and use isolation or access controls when immediate fixes are unavailable. Code review, testing, vulnerability scanning, and monitoring can reveal flaws across the development and operational lifecycle. Reports should distinguish a confirmed vulnerability from a theoretical defect and provide enough technical detail to support validation without unnecessarily enabling exploitation.
Showing 15 most recent headlines
Filtered view
The Hacker News
3 years, 10 months ago
Hackers Targeting WebLogic Servers and Docker APIs for Mining Cryptocurrencies
Malicious actors such as Kinsing are taking advantage of both recently disclosed and older security flaws in Oracle WebLogic Server to deliver cryptocurrency-mining malware
Info Security Magazine
3 years, 10 months ago
Vulnerabilities Found in Airplane WiFi Devices, Passengers' Data Exposed
The flaws affected the Flexlan FX3000 and FX2000 series wireless LAN devices made by Contec
Bleeping Computer
3 years, 10 months ago
CISA orders agencies to patch Windows, iOS bugs used in attacks
CISA added two new vulnerabilities to its list of security bugs exploited in the wild today, including a Windows privilege escalation vulnerability and an arbitrary code execution flaw affecting iPhones and Macs. [...]
The Hacker News
3 years, 10 months ago
Lorenz Ransomware Exploit Mitel VoIP Systems to Breach Business Networks
The operators behind the Lornenz ransomware operation have been observed exploiting a now-patched critical security flaw in Mitel MiVoice Connect to obtain a foothold into target environments for follow-on malicious activities
The Hacker News
3 years, 10 months ago
Microsoft's Latest Security Update Fixes 64 New Flaws, Including a Zero-Day
Tech giant Microsoft on Tuesday shipped fixes to quash 64 new security flaws across its software lineup, including one zero-day flaw that has been actively exploited in real-world attacks
The Hacker News
3 years, 10 months ago
Over 280,000 WordPress Sites Attacked Using WPGateway Plugin Zero-Day Vulnerability
A zero-day flaw in the latest version of a WordPress premium plugin known as WPGateway is being actively exploited in the wild, potentially allowing malicious actors to completely take over affected sites
Krebs on Security
3 years, 10 months ago
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month's Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16, which includes a nifty new privacy and security feature called "Lockdown Mode." And Adobe axed 63 vulnerabilities in a range of products.
Bleeping Computer
3 years, 10 months ago
Microsoft September 2022 Patch Tuesday fixes zero-day used in attacks, 63 flaws
Today is Microsoft's September 2022 Patch Tuesday, and with it comes fixes for an actively exploited Windows vulnerability and a total of 63 flaws. [...]
Dark Reading
3 years, 10 months ago
Lorenz Ransomware Goes After SMBs via Mitel VoIP Phone Systems
The ransomware gang has been seen exploiting a Mitel RCE flaw discovered in VoIP devices in April (and patched in July) to perform double-extortion attacks.
The Hacker News
3 years, 10 months ago
Apple Releases iOS and macOS Updates to Patch Actively Exploited Zero-Day Flaw
Apple has released another round of security updates to address multiple vulnerabilities in iOS and macOS, including a new zero-day flaw that has been used in attacks in the wild
The Register
3 years, 10 months ago
Apple patches iPhone and macOS flaws under active attack
High-value targets tend to get hit Apple has pushed out five security fixes including including two vulnerabilities in its iPhones, iPads and Mac operating systems that are already being exploited.…
Info Security Magazine
3 years, 10 months ago
High Severity Vulnerabilities Found in HP Enterprise Devices
The flaws affect HP EliteBook devices and have CVSS scores between 7.5 and 8.2
Info Security Magazine
3 years, 10 months ago
Oxeye Discovers Several High Severity IDOR Vulnerabilities in Harbor
The flaws were discovered despite Harbor having implemented RBAC on most HTTP endpoints
The Hacker News
3 years, 10 months ago
High-Severity Firmware Security Flaws Left Unpatched in HP Enterprise Devices
A number of firmware security flaws uncovered in HP's business-oriented high-end notebooks continue to be left unpatched in some devices even months after public disclosure