Cloud Security Alliance News Clipping Site

Tag: Exploitation

  • Hacker News: Salt Typhoon Shows There’s No Security Backdoor That’s Only for the "Good Guys"

    —

    by

    system automation
    in

    Source URL: https://www.eff.org/deeplinks/2024/10/salt-typhoon-hack-shows-theres-no-security-backdoor-thats-only-good-guys Source: Hacker News Title: Salt Typhoon Shows There’s No Security Backdoor That’s Only for the "Good Guys" Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a significant breach in U.S. telecommunications attributed to a Chinese-government-affiliated hacking group, highlighting the inherent dangers of backdoor access for law enforcement agencies.…

  • Hacker News: Louis Rossmann on Ethical Data

    —

    by

    system automation
    in

    Source URL: https://futo.org/blog/telemetry-position/ Source: Hacker News Title: Louis Rossmann on Ethical Data Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses the urgent need for transparent and ethical data practices in the software industry, particularly in light of recent privacy violations by major companies. It emphasizes the commitment of the company, FUTO,…

  • Alerts: Oracle Releases Quarterly Critical Patch Update Advisory for October 2024

    —

    by

    system automation
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2024/10/17/oracle-releases-quarterly-critical-patch-update-advisory-october-2024 Source: Alerts Title: Oracle Releases Quarterly Critical Patch Update Advisory for October 2024 Feedly Summary: Oracle released its quarterly Critical Patch Update Advisory for October 2024 to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.  CISA encourages users…

  • Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

    —

    by

    system automation
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2024/10/17/cisa-adds-one-known-exploited-vulnerability-catalog Source: Alerts Title: CISA Adds One Known Exploited Vulnerability to Catalog Feedly Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant…

  • Krebs on Security: Sudanese Brothers Arrested in ‘AnonSudan’ Takedown

    —

    by

    system automation
    in

    Source URL: https://krebsonsecurity.com/2024/10/sudanese-brothers-arrested-in-anonsudan-takedown/ Source: Krebs on Security Title: Sudanese Brothers Arrested in ‘AnonSudan’ Takedown Feedly Summary: The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running Anonymous Sudan (a.k.a. AnonSudan), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens…

  • Hacker News: Critical default credentials in Kubernetes allows SSH root access

    —

    by

    system automation
    in

    Source URL: https://www.theregister.com/2024/10/16/critical_kubernetes_image_builder_bug/ Source: Hacker News Title: Critical default credentials in Kubernetes allows SSH root access Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a critical security vulnerability in the Kubernetes Image Builder, which can allow unauthorized SSH access to virtual machines through default credentials. It highlights the potential risks associated…

  • The Register: Critical default credential bug in Kubernetes Image Builder allows SSH root access

    —

    by

    system automation
    in

    Source URL: https://www.theregister.com/2024/10/16/critical_kubernetes_image_builder_bug/ Source: The Register Title: Critical default credential bug in Kubernetes Image Builder allows SSH root access Feedly Summary: It’s called leaving the door wide open – especially in Proxmox A critical bug in Kubernetes Image Builder could allow unauthorized SSH access to virtual machines (VMs) due to default credentials being enabled during…

  • The Register: SolarWinds critical hardcoded credential bug under active exploit

    —

    by

    system automation
    in

    Source URL: https://www.theregister.com/2024/10/16/solarwinds_critical_hardcoded_credential_bug/ Source: The Register Title: SolarWinds critical hardcoded credential bug under active exploit Feedly Summary: No word yet on scope of attacks A critical, hardcoded credential bug in SolarWinds’ Web Help Desk products has been found and exploited by criminals, according to the US Cybersecurity and Infrastructure Security Agency, which has added the…

  • Alerts: CISA Adds Three Known Exploited Vulnerabilities to Catalog

    —

    by

    system automation
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2024/10/15/cisa-adds-three-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Three Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-30088 Microsoft Windows Kernel TOCTOU Race Condition Vulnerability CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerability CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability These…

  • Cloud Blog: How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends

    —

    by

    system automation
    in

    Source URL: https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023/ Source: Cloud Blog Title: How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends Feedly Summary: Written by: Casey Charrier, Robert Weiner Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were…