Slándáil Research: Security Feeds

Dependency Confusion Vulnerability Found in an Archived Apache Project

FBI warns against using unlicensed crypto transfer services

Postman users are exposing Thousands of live Passwords/API keys

LA County Health Services: Patients' data exposed in phishing attack

Researchers sinkhole PlugX malware server with 2.5 million unique IPs

CVE-2024-29417: a security software vulnerability allows for privilege escalation or auth bypass, even when Windows is locked.

Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster! - Include Security Research Blog

Reddit down in major outage blocking access to web, mobile apps

North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures

Over 1,400 CrushFTP servers vulnerable to actively exploited bug

How MFA Is Falling Short

Predictive Security Startup BforeAI Raises $15 Million

Moriarty v1.2 has been released!

WP Automatic WordPress plugin hit by millions of SQL injection attacks

Multiple Vulnerabilities in Open Devin (Autonomous AI Software Engineer)

Palo Alto Networks Shares Remediation Advice for Hacked Firewalls

Autodesk Drive Abused in Phishing Attacks

FTC Sending $5.6 Million in Refunds to Ring Customers Over Security Failures

Vulnerabilities Expose Brocade SAN Appliances, Switches to Hacking

Canada Cyber Centre News

Using Bluetooth technology (ITSAP.00.011)

Network Threats: A Step-by-Step Attack Demonstration

Exploring Vulnerabilities in Embedded Devices: A Case Study of an IP Phone

DOJ Arrests Founders of Crypto Mixer Samourai for $2 Billion in Illegal Transactions

Endpoint Security Firm ThreatLocker Raises $115 Million in Series D Funding

New Brokewell malware takes over Android devices, steals data

IBM Acquiring HashiCorp for $6.4 Billion

Literal Security Measures

Google Postpones Third-Party Cookie Deprecation Amid U.K. Regulatory Scrutiny

State-Sponsored Hackers Exploit Two Cisco Zero-Day Vulnerabilities for Espionage

Cisco Systems Joins Microsoft, IBM in Vatican Pledge to Ensure Ethical Use and Development of AI

I got a 10% discount ticket for 1 Typhooncon training

US charges Samourai cryptomixer founders for laundering $100 million

Maximum severity Flowmon bug has a public exploit, patch now

Cisco ASA exploit in the wild.

XZ Utils Rundown: What We Learned and What To Do Next

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms

ArcaneDoor hackers exploit Cisco zero-days to breach govt networks

Google Meet opens client-side encrypted calls to non Google users

Windows 11 KB5036980 update goes live with Start Menu ads

KnowBe4 Plans to Acquire Egress for Email Security Tech

Navigating Vendor Speak: A Security Practitioner’s Guide to Seeing Through the Jargon

Canada Cyber Centre News

Cyber Activity Impacting CISCO ASA VPNs

North Korean Hackers Hijack Antivirus Updates for Malware Delivery

18 vulnerabilities in Brocade SANnav

Ring customers get $5.6 million in privacy breach settlement

U.S. Treasury Sanctions Iranian Firms and Individuals Tied to Cyber Attacks

Researchers Detail Multistage Attack Hijacking Systems with SSLoad, Cobalt Strike

Tines Bags $50 Million Funding for Security Workflow Automation

Google Patches Critical Chrome Vulnerability

ASPJinjaObfuscator: Heavily obfuscated ASP web shell generation tool.

Vendors

USN-6754-1: nghttp2 vulnerabilities

USN-6753-1: CryptoJS vulnerability

USN-6751-1: Zabbix vulnerabilities

USN-6752-1: FreeRDP vulnerabilities

USN-6750-1: Thunderbird vulnerabilities

DSA-5674-1 pdns-recursor - security update

USN-6743-3: Linux kernel (Azure) vulnerabilities

USN-6657-2: Dnsmasq vulnerabilities

Palo Alto Advisories

PAN-SA-2024-0005 Informational Bulletin: Proof of Concept (PoC) Bypasses Protection Modules in Cortex XDR Agent (Severity: NONE)

USN-6749-1: FreeRDP vulnerabilities

USN-6748-1: Sanitize vulnerabilities

FreeBSD Security Advisories

USN-6747-1: Firefox vulnerabilities

FreeBSD-EN-24:09.zfs

USN-6742-2: Linux kernel vulnerabilities

USN-6746-1: Google Guest Agent and Google OS Config Agent vulnerability

USN-6728-3: Squid vulnerability

DSA-5673-1 glibc - security update

USN-6743-2: Linux kernel (Low Latency) vulnerabilities

USN-6744-2: Pillow vulnerability

USN-6745-1: Percona XtraBackup vulnerability

USN-6738-1: LXD vulnerability

USN-6744-1: Pillow vulnerability

Elastic advisories

Elastic Security Statement for CVE-2024-3094, xz versions 5.6.0 and 5.6.1

DSA-5669-1 guix - security update

DSA-5670-1 thunderbird - security update

DSA-5671-1 openjdk-11 - security update

DSA-5672-1 openjdk-17 - security update

DSA-5668-1 chromium - security update

USN-6743-1: Linux kernel vulnerabilities

USN-6742-1: Linux kernel vulnerabilities

USN-6741-1: Linux kernel vulnerabilities

USN-6740-1: Linux kernel vulnerabilities

USN-6739-1: Linux kernel vulnerabilities

Palo Alto Advisories

CVE-2024-3400 PAN-OS: Arbitrary File Write Leads to OS Command Injection Vulnerability in GlobalProtect (Severity: CRITICAL)

Palo Alto Advisories

CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect (Severity: CRITICAL)

DSA-5666-1 flatpak - security update

DSA-5667-1 tomcat9 - security update

USN-6737-1: GNU C Library vulnerability

VMWare Advisories

VMSA-2024-0008

USN-6729-2: Apache HTTP Server vulnerabilities

USN-6726-3: Linux kernel (Xilinx ZynqMP) vulnerabilities

Jenkins advisories

Jenkins Security Advisory 2024-04-17

Microsoft Advisories

Congratulations to the Top MSRC 2024 Q1 Security Researchers!

DSA-5663-1 firefox-esr - security update

DSA-5664-1 jetty9 - security update

DSA-5665-1 tomcat10 - security update

USN-6726-2: Linux kernel (IoT) vulnerabilities

USN-6725-2: Linux kernel (AWS) vulnerabilities

USN-6724-2: Linux kernel vulnerabilities

Oracle Advisories

Oracle Critical Patch Update Advisory - April 2024

Advisories

CVE-2024-31609 | BOSSCMS 3.10 Code Configuration cross site scripting

CVE-2024-31610 | code-projects Simple School Management System 1.0 File unrestricted upload

CVE-2024-3197 | Plus Addons for Elementor Plugin up to 5.4.2 on WordPress Custom Attributes cross site scripting

CVE-2024-2920 | WP-Members Membership Plugin up to 3.4.9.3 on WordPress information disclosure

CVE-2024-3199 | Plus Addons for Elementor Plugin up to 5.4.2 on WordPress Countdown Widget cross site scripting

CVE-2024-1945 | ARForms Form Builder Plugin up to 1.6.4 on WordPress Option authorization

CVE-2024-3890 | Happy Addons for Elementor Plugin up to 3.10.6 on WordPress Calendly Widget cross site scripting

CVE-2024-3678 | Blog2Social Plugin up to 7.4.2 on WordPress information disclosure

CVE-2024-33602 | GNU C Library NSS Callback buffer overflow

CVE-2024-33601 | GNU C Library Netgroup Cache allocation of resources

CVE-2024-33600 | GNU C Library Netgroup Cache Insertion null pointer dereference

CVE-2024-33599 | GNU C Library Netgroup Cache stack-based overflow

CVE-2024-32868 | Zitadel excessive authentication

CVE-2024-32324 | Shenzhen Libituo Technology LBT-T300-T400 3.2 rc config_vpn_pptp vpn_client_ip buffer overflow

CVE-2024-30939 | Yealink VP59 Teams Edition 91.15.0.118 Factory Reset Local Privilege Escalation

CVE-2022-36028 | BigBlueButton Greenlight up to 2.12.x Login Page return_to redirect

CVE-2022-36029 | BigBlueButton Greenlight up to 2.12.x Login Page return_to redirect

CVE-2024-32467 | MeterSphere up to 2.10.13-lts access control (GHSA-7499-q88f-mxqp)

CVE-2024-31615 | ThinkCMF 6.0.9 UeditorController.php unrestricted upload

CVE-2024-32645 | Vyper up to 0.3.10 raw_log storage input validation (GHSA-xchq-w5r3-4wg3)

CVE-2024-32481 | Vyper prior 0.4.0b1 stmt.parse_For_range numeric conversion (GHSA-ppx5-q359-pvwj)

CVE-2024-32647 | Vyper up to 0.3.10 neutralization of directives (GHSA-3whq-64q2-qfj6)

CVE-2024-32648 | Vyper up to 2.x Key locking (ID 2455)

CVE-2024-32649 | Vyper up to 0.3.10 build_IR neutralization of directives (GHSA-5jrj-52x8-m64h)

CVE-2024-32646 | Vyper up to 0.3.10 slice start/length buffer overflow (GHSA-r56x-j438-vw5m)

CVE-2024-28241 | GLPI Agent up to 1.7.1 Installation privileges management

CVE-2024-31574 | TWCMS 2.6 cross site scripting

CVE-2024-29660 | DedeCMS 5.7 stepselect_main.php cross site scripting

CVE-2024-1102 | Red Hat Keycloak dbProperties information disclosure

CVE-2023-6596 | Red Hat OpenShift Container Platform resource consumption (RHSA-2024:0485)

CVE-2024-32358 | JPress 5.1.0 Custom Plug-In Module Privilege Escalation

CVE-2024-30890 | ED01-CMS 1.0 categories.php cross site scripting

CVE-2024-1139 | Red Hat Advanced Cluster Management for Kubernetes information disclosure

CVE-2024-25624 | dfir-iris iris-web up to 2.4.5 Template special elements used in a template engine

CVE-2024-28240 | GLPI Agent up to 1.7.1 on Windows URL denial of service

CVE-2024-32236 | CmsEasy up to 7.7 index.php update information disclosure

CVE-2024-33592 | SoftLab Radio Player Plugin up to 2.0.73 on WordPress server-side request forgery

CVE-2024-25569 | Mathieu Malaterre Grassroot DICOM 3.0.23 DICOM File RAWCodec::DecodeBytes out-of-bounds (TALOS-2024-1944)

CVE-2024-22391 | Mathieu Malaterre Grassroot DICOM 3.0.23 File LookupTable::SetLUT memory corruption (TALOS-2024-1924)

CVE-2024-22373 | Mathieu Malaterre Grassroot DICOM 3.0.23 DICOM File DecodeByStreamsCommon memory corruption (TALOS-2024-1935)

Ubuntu Security Notice USN-6750-1

Ubuntu Security Notice USN-6743-3

Ubuntu Security Notice USN-6657-2

Ubuntu Security Notice USN-6749-1

Red Hat Security Advisory 2024-2060-03

Red Hat Security Advisory 2024-2055-03

Red Hat Security Advisory 2024-2045-03

Red Hat Security Advisory 2024-2044-03

Red Hat Security Advisory 2024-2042-03

Red Hat Security Advisory 2024-2041-03

Blogs

How to Avoid Romance Scams

SpecterOps Team Blog

Nemesis 1.0.0

A Five-Phase Strategy for Embracing Industry 4.0 with Cisco

How to Protect Your Smartphone from SIM Swapping

NCCGroup Blog

Sifting through the spines: identifying (potential) Cactus ransomware victims

Transforming Tech: Why Leadership Must Start with Our Girls in STEM

ArcaneDoor Unlocked: Tackling State-Sponsored Cyber Espionage in Network Perimeters

Unveiling the Hidden Power of the CMDB in Cybersecurity

Retail Tech Deep-Dive: Meraki Switching

Helping the health of our planet, one bottle at a time

Celebrating a New Era in Partnering: NTT DATA and Cisco

How to Tell If Your Text Message Is Real

How to Spot Dating Scams

Staying Five Steps Ahead of Cyber Risk

CCNA in the Age of AI

Microsoft Security Blog

New Microsoft Incident Response guide helps simplify cyberthreat investigations

MITRE ATT&CK

ATT&CK v15 Brings the Action

Full Stack Observability: Everything, everywhere, all at once

How Cisco is Redefining Security and Our Partner Experience

New Cisco Defense Orchestrator (CDO) API

Krebs on Security

Russian FSB Counterintelligence Chief Gets 9 Years in Cybercrime Bribery Scheme

Empowering Small Businesses in the Digital Age: A Must-Read Guide to Web Application & API Security

Microsoft Security Blog

Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

Customers Praise the Surprising Longevity and Adaptability of Cisco UCS

Find Your Path to Unmatched Security and Unified Experiences

It’s Earth Day! Let’s talk Circularity, Growth and Profitability!

How to Spot AI Audio Deepfakes at Election Time

WordPress LayerSlider Plugin: SQL Injection Vulnerability

Transforming Operations to Eliminate Technical Debt

How To Teach Your Kids About DeepFakes

Amazon Security Bulletins

How To Teach Your Kids About Deepfakes

AWS Response to March 2024 CSRB report

Introducing the 7th Annual Partner Innovation Challenge: Featuring an Exciting New Prize Category

How We’re Delivering Next-Gen Workforce Collaboration with Cisco Private 5G

Project Zero

The Windows Registry Adventure #1: Introduction and research results

For Cisco Insider Wouter Hindriks, curiosity and passion for problem solving are keys to success.

MITRE ATT&CK

ATT&CK 2024 Roadmap

Project Zero

The Windows Registry Adventure #2: A brief history of the feature

Earth Day: How we’re helping our social and environmental systems heal and thrive

TotalCloud Insights: Safeguarding Your Cloud Database from SQL Server Threats and Lateral Movement Risks

Cisco at Hannover Messe 2024: Know Before You Go

Innovation and Continuity: Cisco Meraki in the Education Sector

Turning Cisco’s Tuition Reimbursement Green

Cisco Hypershield: Security reimagined — hyper-distributed security for the AI-scale data center

Cisco Hypershield: A New Era of Distributed, AI-Native Security

Cisco Hypershield: Reimagining Security

Redline Stealer: A Novel Approach

Microsoft Security Blog

Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters

The network effect: The secret weapon for smart manufacturing

SpecterOps Team Blog

LSA Whisperer

CERTS

Mitel security advisory (AV24-226)

HPE security advisory (AV24-225)

Belgium CERT.BE

Warning: Actively Exploited Vulnerabilities in Cisco Adaptive Security Appliance and Firepower Threat Defense Software. Patch Immediately!

Drupal security advisory (AV24-224)

UK NCSC

Pathways: exploring a new way to achieve Cyber Essentials certification

Cisco security advisory (AV24-223)

Cyber activity impacting CISCO ASA devices

Google Chrome security advisory (AV24-222)

CrushFTP security advisory (AV24-221)

Linux Kernel (Live Patch 10 for SLE 15 SP5): CVSS (Max): 7.8

Linux Kernel (Live Patch 6 for SLE 15 SP5): CVSS (Max): 7.8

Linux Kernel (Live Patch 47 for SLE 12 SP5): CVSS (Max): 7.8

jasper: CVSS (Max): 7.5

Ruby: CVSS (Max): None

Google Guest Agent and Google OS Config Agent: CVSS (Max): 5.9

opensc: CVSS (Max): 4.4

kubernetes1.24: CVSS (Max): 2.7

kubernetes1.23: CVSS (Max): 2.7

glibc: CVSS (Max): 8.8

Dell security advisory (AV24-220)

Finland NCSC-Fi

The National Cyber Security Centre Finland’s weekly review – 16/2024

UK NCSC

'NCSC Cyber Series' podcast now available

shim: CVSS (Max): 8.4

apache-commons-configuration2: CVSS (Max): 4.4

Percona XtraBackup: CVSS (Max): 7.8

LXD: CVSS (Max): 5.9

Pillow: CVSS (Max): 7.3

samba: CVSS (Max): 6.5

Linux Kernel (Live Patch 50 for SLE 12 SP5): CVSS (Max): 7.8

apache-commons-configuration: CVSS (Max): 4.4

polkit: CVSS (Max): None

glibc: CVSS (Max): 8.2

Linux Kernel (Live Patch 51 for SLE 12 SP5): CVSS (Max): 7.8

openjdk-17: CVSS (Max): 3.7

openjdk-11: CVSS (Max): 3.7

Linux Kernel RT (Live Patch 7 for SLE 15 SP5): CVSS (Max): 7.8

Linux Kernel RT (Live Patch 10 for SLE 15 SP5): CVSS (Max): 7.8

guix: CVSS (Max): 6.3

Ubuntu security advisory (AV24-219)

IBM security advisory (AV24-218)

Red Hat security advisory (AV24-217)

Belgium CERT.BE

Warning: CrushFTP <11.1.0 Has a Vulnerability That Lets an Attacker Escape the Virtual File System and Download System Files

Austria CERT.at

Double Agents and User Agents: Navigating the Realm of Malicious Python Packages

[Control systems] CISA ICS security advisories (AV24-216)

Finland NCSC-Fi

Data breaches to Palo Alto GlobalProtect products – requires immediate action

Mozilla Thunderbird: CVSS (Max): 7.5*

wireshark: CVSS (Max): 7.5

graphviz: CVSS (Max): 3.4

MozillaFirefox: CVSS (Max): 7.5*