0x40k<p>Whoa, talk about déjà vu! Seems like Firefox is playing catch-up right after Chrome dropped a fix for a sandbox escape. 🤯 Keep an eye out for CVE-2025-2857.</p><p>So, what's the deal? In short, this nasty bug could let an attacker break right out of the browser's protective sandbox. And *that* means they could potentially gain full access to your system. Yeah, pretty scary stuff. 😱</p><p>If you're running Firefox on Windows, heads up! This affects versions 136.0.4, ESR 115.21.1, and ESR 128.8.1. This whole situation feels familiar because Chrome *just* patched CVE-2025-2783, a similar issue that attackers were already actively exploiting out in the wild!</p><p>Make no mistake, sandbox escapes are a huge deal. As a pentester, I can tell you: vulnerabilities like this get weaponized *fast*. Don't wait around.</p><p>Seriously, update your Firefox ASAP! Trust me, you don't want to deal with the fallout if someone exploits this. It could get costly, fast.</p><p>Ever seen a browser exploit do its thing live? Wild, right? Drop your stories below!</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firefox</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/updateNOW" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updateNOW</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
social.tchncs.de is one of the many independent Mastodon servers you can use to participate in the fediverse.
A friendly server from Germany – which tends to attract techy people, but welcomes everybody. This is one of the oldest Mastodon instances.
Administered by:
Server stats:
3.9Kactive users
social.tchncs.de: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.6
#updatenow
2 posts · 2 participants · 0 posts today
Bob Carver<p><a href="https://thehackernews.com/2025/03/zero-day-alert-google-releases-chrome.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2025/03/zero</span><span class="invisible">-day-alert-google-releases-chrome.html</span></a><br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Google</span></a> <a href="https://infosec.exchange/tags/chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>chrome</span></a> <a href="https://infosec.exchange/tags/browser" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>browser</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
Bob Carver<p><a href="https://www.forbes.com/sites/daveywinder/2025/03/12/critical-windows-warning-as-6-zero-day-attacks-confirmed-update-now/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forbes.com/sites/daveywinder/2</span><span class="invisible">025/03/12/critical-windows-warning-as-6-zero-day-attacks-confirmed-update-now/</span></a><br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Windows</span></a> <a href="https://infosec.exchange/tags/0Days" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>0Days</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
Bob Carver<p><a href="https://www.theverge.com/news/609546/apple-iphone-ipad-usb-restricted-mode-zero-day-exploit-patch" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">theverge.com/news/609546/apple</span><span class="invisible">-iphone-ipad-usb-restricted-mode-zero-day-exploit-patch</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/iPhone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPhone</span></a> <a href="https://infosec.exchange/tags/iPad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPad</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
Bob Carver<p><a href="https://www.bleepingcomputer.com/news/security/apple-fixes-this-years-first-actively-exploited-zero-day-bug/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/apple-fixes-this-years-first-actively-exploited-zero-day-bug/</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/Oday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Oday</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a> <a href="https://infosec.exchange/tags/iPhone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPhone</span></a> <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>macOS</span></a></p>
nemo™ 🇺🇦<p>🚨 Security Alert! 🚨 Fortinet has flagged a critical vulnerability that allows attackers to take over devices remotely! 😱 If you're using FortiWLM versions 8.6.0-8.6.5 or 8.5.0-8.5.4, update immediately! 🛡️ This flaw was first discovered in May 2023 and remained unaddressed for months! 🔒 Read more here: <a href="https://www.techradar.com/pro/security/fortinet-flags-some-worrying-security-bugs-coming-back-from-the-dead" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">techradar.com/pro/security/for</span><span class="invisible">tinet-flags-some-worrying-security-bugs-coming-back-from-the-dead</span></a> <a href="https://mas.to/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mas.to/tags/Fortinet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Fortinet</span></a> <a href="https://mas.to/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://mas.to/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a> <a href="https://mas.to/tags/newz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>newz</span></a></p>
nemo™ 🇺🇦<p>Apple has rolled out iOS 18.2, fixing a serious encryption flaw in its Passwords app! 🔒 This update addresses a vulnerability that exposed users to potential MITM attacks due to unencrypted HTTP connections. 🚨 Users are urged to update their devices to ensure their passwords remain secure. 🛡️ <a href="https://mas.to/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://mas.to/tags/iOS182" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iOS182</span></a> <a href="https://mas.to/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mas.to/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a> <a href="https://mas.to/tags/newz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>newz</span></a> <br>Read more: <a href="https://cyberinsider.com/apple-fixes-encryption-flaw-in-passwords-app-with-ios-18-2-update/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cyberinsider.com/apple-fixes-e</span><span class="invisible">ncryption-flaw-in-passwords-app-with-ios-18-2-update/</span></a></p>
Bob Carver<p><a href="https://thehackernews.com/2024/11/apple-releases-urgent-updates-to-patch.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2024/11/appl</span><span class="invisible">e-releases-urgent-updates-to-patch.html</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/ZeroDays" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ZeroDays</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p>
Bob Carver<p><a href="https://thehackernews.com/2024/05/apple-and-google-launch-cross-platform.html?m=1" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2024/05/appl</span><span class="invisible">e-and-google-launch-cross-platform.html?m=1</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/bluetooth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bluetooth</span></a> <a href="https://infosec.exchange/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>android</span></a> <a href="https://infosec.exchange/tags/apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apple</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
Bob Carver<p><a href="https://www.zdnet.com/article/update-your-chrome-browser-asap-google-has-confirmed-a-zero-day-exploited-in-the-wild/#ftag=CAD-03-10abf5f" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">zdnet.com/article/update-your-</span><span class="invisible">chrome-browser-asap-google-has-confirmed-a-zero-day-exploited-in-the-wild/#ftag=CAD-03-10abf5f</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Chrome</span></a> <a href="https://infosec.exchange/tags/0Day" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>0Day</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p>
Bob Carver<p><a href="https://www.zdnet.com/article/update-your-chrome-browser-asap-google-has-confirmed-a-zero-day-exploited-in-the-wild/#ftag=CAD-03-10abf5f" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">zdnet.com/article/update-your-</span><span class="invisible">chrome-browser-asap-google-has-confirmed-a-zero-day-exploited-in-the-wild/#ftag=CAD-03-10abf5f</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Chrome</span></a> <a href="https://infosec.exchange/tags/0Day" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>0Day</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p>
Bob Carver<p>LG fixes webOS security flaws that could let attackers remotely gain root access<br><a href="https://www.zdnet.com/article/lg-fixes-webos-security-flaws-that-could-let-attackers-remotely-gain-root-access/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">zdnet.com/article/lg-fixes-web</span><span class="invisible">os-security-flaws-that-could-let-attackers-remotely-gain-root-access/</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/LG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LG</span></a> <a href="https://infosec.exchange/tags/webOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webOS</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>"Update for Chrome: Enhancing Security Against Remote Code Execution Vulnerabilities"</p><p>Google Chrome has recently been updated across Windows, Mac, and Linux platforms, with the latest versions being 122.0.6261.111/.112 for Windows and Mac, and 122.0.6261.111 for Linux. This update incorporates several security fixes. It addresses high issues such as memory access vulnerabilities and other potential threats. Noteworthy fixes include a high-severity out-of-bounds memory access flaw, a misimplementation in the V8 engine, and a use-after-free vulnerability in FedCM. </p><p>For users on versions before 122.0.6261.111/112, it is strongly advised to update Google Chrome to ensure protection against these vulnerabilities.</p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/GoogleChrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GoogleChrome</span></a> <a href="https://infosec.exchange/tags/VulnerabilityManagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>VulnerabilityManagement</span></a> <a href="https://infosec.exchange/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RCE</span></a> <a href="https://infosec.exchange/tags/CVE20242173" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE20242173</span></a> <a href="https://infosec.exchange/tags/CVE20242174" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE20242174</span></a> <a href="https://infosec.exchange/tags/CVE20242176" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE20242176</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p><p>For more detailed information, please refer to the official announcements on <a href="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html" rel="nofollow noopener noreferrer" target="_blank">Google Chrome Releases</a> and <a href="https://www.hkcert.org/security-bulletin/google-chrome-remote-code-execution-vulnerabilities_20240307" rel="nofollow noopener noreferrer" target="_blank">HKCERT</a>. 🌍🔒🛡️</p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>" <a href="https://infosec.exchange/tags/CiscoVuln" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CiscoVuln</span></a> Alert 🚨 CVE-2024-20338 Strikes Cisco Secure Client for Linux 🐧💥"</p><p>A newly disclosed vulnerability, CVE-2024-20338, with a CVSS score of 7.3, targets the Cisco Secure Client for Linux, specifically the ISE Posture Module. This critical flaw allows local attackers to potentially execute arbitrary code with root privileges due to an uncontrolled search path element. Cisco has promptly issued an update to patch this security loophole. Kudos to Ivan Agarkov of Wargaming for the find! Stay vigilant and update ASAP! 🛡️✅</p><p>Tags: <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/Cisco" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cisco</span></a> <a href="https://infosec.exchange/tags/LinuxSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LinuxSecurity</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/CVE2024" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2024</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p><p><a href="https://www.auscert.org.au/bulletins/ESB-2024.1448/" rel="nofollow noopener noreferrer" target="_blank">Source</a></p>
Bob Carver<p><a href="https://www.tomsguide.com/phones/iphones/apple-just-fixed-two-major-iphone-security-flaws-install-these-emergency-updates-now" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">tomsguide.com/phones/iphones/a</span><span class="invisible">pple-just-fixed-two-major-iphone-security-flaws-install-these-emergency-updates-now</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/iOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iOS</span></a> <a href="https://infosec.exchange/tags/iPadOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPadOS</span></a> <a href="https://infosec.exchange/tags/0days" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>0days</span></a> <a href="https://infosec.exchange/tags/updatenow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>updatenow</span></a></p>
Matt Willemsen<p>Cybercriminal groups actively exploiting ‘catastrophic’ ScreenConnect bug<br><a href="https://therecord.media/connectwise-screenconnect-bug-cybercrime-exploitation" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">therecord.media/connectwise-sc</span><span class="invisible">reenconnect-bug-cybercrime-exploitation</span></a> <a href="https://mastodon.social/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ConnectWise</span></a>’s <a href="https://mastodon.social/tags/ScreenConnect" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ScreenConnect</span></a> <a href="https://mastodon.social/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a>!!! <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://mastodon.social/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerability</span></a> <a href="https://mastodon.social/tags/criticalthreat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>criticalthreat</span></a> <a href="https://mastodon.social/tags/EmbarrassinglyEasy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>EmbarrassinglyEasy</span></a>” <a href="https://mastodon.social/tags/hackers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hackers</span></a> <a href="https://mastodon.social/tags/exploit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>exploit</span></a></p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>"🚨 Critical Vulnerability Alert: ConnectWise ScreenConnect Under Attack! 🚨"</p><p>Sophos researchers have unveiled a situation for users of ConnectWise ScreenConnect, detailing how CVE-2024-1709 and CVE-2024-1708 vulnerabilities are being exploited to deliver malware, including the notorious LockBit ransomware. These vulnerabilities open the door for attackers to execute arbitrary code and take control of unpatched systems. </p><p>ConnectWise ScreenConnect, a remote access software, has vulnerabilities being exploited by hackers to deliver malware, including ransomware, to businesses. Critical vulnerabilities allow unauthorized access and command execution. It's essential to update ScreenConnect to version 23.9.8 or later to mitigate these risks. Cloud-hosted ScreenConnect users are safe, but on-premise versions need manual updates. </p><p>To protect your organization from specific security weaknesses in ScreenConnect software, follow these simplified steps:</p><ol><li>Find all ScreenConnect software in your network, including those managed by others. It's essential to know where it's installed to understand your risk.</li><li>Isolate or remove the ScreenConnect Client from devices until the server is securely updated or thoroughly checked. If you don't control the server, removing the client might be the best quick fix.</li><li>Examine devices with ScreenConnect for signs of hacking, like new unknown user accounts, strange software behavior, and attempts to disable security features.</li><li>If you find anything suspicious, start your incident response plan to tackle the issue and prevent further damage. Specifically, look for indicators of two main vulnerabilities (CVE-2024-1709 & CVE-2024-1708) by examining server versions, IP connections, and unexpected file presence, which could show a breach. 🛡️💻🔐</li></ol><p>Tags: <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/ConnectWiseScreenConnect" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ConnectWiseScreenConnect</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Malware</span></a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/LockBit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LockBit</span></a> <a href="https://infosec.exchange/tags/CVE2024" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2024</span></a>-1709 <a href="https://infosec.exchange/tags/CVE2024" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2024</span></a>-1708 <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a> <a href="https://infosec.exchange/tags/StaySecure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>StaySecure</span></a></p><p>Source: <a href="https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/" rel="nofollow noopener noreferrer" target="_blank">Sophos News</a></p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>🚨 <a href="https://infosec.exchange/tags/SecurityAlert" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SecurityAlert</span></a> 🚨</p><p>CVE-2024-21488: Arbitrary Command Injection in Node.js's network package (versions < 0.7.0).</p><p>⚠️ This critical vulnerability affects older versions of the network package for Node.js. It's classified as an Arbitrary Command Injection due to insufficient input sanitization in the <code>child_process exec</code> function.</p><p>🔍 Specific Risk: The flaw is exploitable when attacker-controlled input is fed into the <code>mac_address_for</code> function, allowing execution of arbitrary commands on the OS hosting the network package.</p><p>🔗 Stay informed and secure: <a href="https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371" rel="nofollow noopener noreferrer" target="_blank">SNYK-JS-NETWORK-6184371</a></p><p><a href="https://infosec.exchange/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NodeJS</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a></p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>"🚨 Multiple issues in Jenkins, an open-source automation server that is widely used in software development 🐛🔧"</p><p>Jenkins, a popular automation server, has a vulnerability in its command line interface (CLI). This issue stems from the args4j library's feature that replaces an "@" character followed by a file path with the contents of that file. This feature, enabled by default in Jenkins versions up to 2.441 and LTS 2.426.2, allows attackers to read files on the Jenkins controller's file system. Users with "Overall/Read" permission can read entire files, while those without this permission can read the first few lines, depending on the CLI commands available.</p><p>The vulnerability also extends to binary files, including cryptographic keys, albeit with some limitations. Various attack vectors have been identified, exploiting this flaw to achieve remote code execution or other malicious objectives. These include manipulating the "Resource Root URL" functionality, forging "Remember me" cookies, conducting stored cross-site scripting (XSS) attacks through build logs, bypassing CSRF protection, decrypting secrets stored in Jenkins, deleting items, and downloading Java heap dumps. These attacks rely on specific conditions, such as the ability to retrieve binary secrets, access to Jenkins's web session ID, and the attacker's knowledge or guesswork about user names with "Overall/Read" permission.</p><p>🚨💻</p><p>Key vulnerabilities include:</p><ul><li>CVE-2024-23897: Arbitrary file read vulnerability through the CLI can lead to RCE</li><li>CVE-2024-23899: Git server Plugin allowing file content exposure that can lead to RCE.</li><li>CVE-2024-23900: Matrix Project Plugin with user-defined axis names issues.</li><li>CVE-2024-23901 & CVE-2024-23902: GitLab Branch Source Plugin with risks of crafted Pipeline builds and CSRF vulnerabilities.</li><li>CVE-2024-23903: Potential for webhook token theft in GitLab Branch Source Plugin.</li><li>CVE-2023-6147 & CVE-2023-6148: Qualys Policy Compliance Scanning Connector Plugin with XSS and XXE vulnerabilities.</li></ul><p>🔐 Recommended actions:</p><ul><li>Update Git server Plugin to version 99.101.v720e86326c09 or later.</li><li>Update GitLab Branch Source Plugin to version 688.v5fa_356ee8520 or later.</li><li>Update Matrix Project Plugin to version 822.824.v14451b_c0fd42 or later.</li><li>Update Qualys Policy Compliance Scanning Connector Plugin to version 1.0.6 or later.</li><li>For detailed mitigation steps, see Jenkins' advisory: <a href="https://jenkins.io/security/advisory/2024-01-24/" rel="nofollow noopener noreferrer" target="_blank">Jenkins Security Advisory</a>.</li></ul><p>Stay alert and ensure your Jenkins environment is up-to-date! 🛡️💡</p><p>Sources: <a href="https://jenkins.io/security/advisory/2024-01-24/" rel="nofollow noopener noreferrer" target="_blank">Jenkins Security Advisory</a> and <a href="https://www.tenable.com/plugins/pipeline/issues/164582" rel="nofollow noopener noreferrer" target="_blank">Tenable</a>,</p><p>Tags: <a href="https://infosec.exchange/tags/Jenkins" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Jenkins</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/CVE2024" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2024</span></a> <a href="https://infosec.exchange/tags/CyberThreat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberThreat</span></a> <a href="https://infosec.exchange/tags/PluginSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PluginSecurity</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a> 🚀👨💻🛠️</p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>"⚠️ Alert: Google Chrome Zero-Day CVE-2023-7024 Exploited in the Wild! 🌐💥"</p><p>Google's latest patch addresses a critical zero-day vulnerability in Chrome, CVE-2023-7024. Identified as a heap-based buffer overflow in WebRTC, it's exploited in the wild. Chrome versions before 120.0.6099.129 are vulnerable. 🚨</p><p>Details: CVE-2023-7024, discovered by Google TAG, affects several browsers using WebRTC. It's the eighth zero-day patched by Google this year, underscoring the evolving cybersecurity landscape.</p><p>Mitigation: Users should urgently update to Chrome 120.0.6099.129/130 (for Windows) or 120.0.6099.129 (for Mac/Linux) to protect against this and other security fixes included in recent Chrome updates. 🛡️</p><p>Source: <a href="https://threatprotect.qualys.com/2023/12/21/google-chrome-zero-day-vulnerability-exploited-in-the-wild-cve-2023-7024/" rel="nofollow noopener noreferrer" target="_blank">Qualys ThreatPROTECT</a> by Diksha Ojha; <a href="https://chromereleases.googleblog.com/2023" rel="nofollow noopener noreferrer" target="_blank">Chrome Releases Blog</a></p><p>Tags: <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/GoogleChrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GoogleChrome</span></a> <a href="https://infosec.exchange/tags/ZeroDay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ZeroDay</span></a> <a href="https://infosec.exchange/tags/CVE2023" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2023</span></a> <a href="https://infosec.exchange/tags/WebRTC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebRTC</span></a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UpdateNow</span></a> <a href="https://infosec.exchange/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttack</span></a> <a href="https://infosec.exchange/tags/InfoSecExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSecExchange</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload