Collaborate Disseminate
Organizations urged to hunt for potential compromise as exploitation of a recent Ivanti enterprise VPN vulnerability begins.
The post Exploitation of Another Ivanti VPN Vulnerability Observed appeared first on SecurityWeek.
Continue reading Exploitation of Another Ivanti VPN Vulnerability Observed
A zero-day vulnerability that, when triggered, could crash the Windows Event Log service on all supported (and some legacy) versions of Windows could spell trouble for enterprise defenders. Discovered by a security researcher named Florian and reported… Continue reading A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs
PoC exploit code targeting a critical Jenkins vulnerability patched last week is already publicly available.
The post PoC Exploit Published for Critical Jenkins Vulnerability appeared first on SecurityWeek.
Continue reading PoC Exploit Published for Critical Jenkins Vulnerability
Several proof-of-concept (PoC) exploits for a recently patched critical vulnerability (CVE-2024-23897) in Jenkins have been made public and there’s evidence of exploitation in the wild. About CVE-2024-23897 Jenkins is a widely used Java-based ope… Continue reading Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)
Proof-of-concept (PoC) exploit code for a critical vulnerability (CVE-2024-0204) in Fortra’s GoAnywhere MFT solution has been made public, sparking fears that attackers may soon take advantage of it. Fortra’s GoAnywhere MFT is a web-based m… Continue reading PoC exploit for easily exploitable Fortra GoAnywhere MFT vulnerability released (CVE-2024-0204)
PoC code exploiting a critical Fortra GoAnywhere MFT vulnerability gets published one day after public disclosure.
The post PoC Code Published for Just-Disclosed Fortra GoAnywhere Vulnerability appeared first on SecurityWeek.
Continue reading PoC Code Published for Just-Disclosed Fortra GoAnywhere Vulnerability
Attackers are trying to leverage public proof-of-exploit (PoC) exploit code for CVE-2023-50164, the recently patched path traversal vulnerability in Apache Struts 2. “Attackers aim to deploy webshells, with some cases targeting the parameter R… Continue reading Attackers are trying to exploit Apache Struts vulnerability (CVE-2023-50164)
SafeBreach researchers have discovered eight new process injection techniques that can be used to covertly execute malicious code on Windows systems. Dubbed “Pool Party” because they (ab)use Windows thread pools, these process injection tec… Continue reading “Pool Party” process injection techniques evade EDRs
Arcserve has fixed critical security vulnerabilities (CVE-2023-41998, CVE-2023-41999, CVE-2023-42000) in its Unified Data Protection (UDP) solution, PoCs for which have been published by Tenable researchers on Monday. The vulnerabilities Arcserve UDP i… Continue reading PoCs for critical Arcserve UDP vulnerabilities released
A proof-of-concept (PoC) exploit for a high-severity flaw in Splunk Enterprise (CVE-2023-46214) that can lead to remote code execution has been made public. Users are advised to implement the provided patches or workarounds quickly. About CVE-2023-4621… Continue reading PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214)