The UK’s Sellafield nuclear waste processing and storage site has been fined £332,500 by regulators after its IT systems were found to have been left vulnerable to hackers and unauthorised access for years.
Read more in my article on the Hot for Security blog.
The Counter Ransomware Initiative has released new guidance discouraging organizations from making ransomware payments
What is the Vulnerability?Attackers are actively exploiting CVE-2024-45519, a critical Zimbra vulnerability that allows attackers to execute arbitrary commands on vulnerable systems. CVE-2024-45519 is a vulnerability in the postjournal service used for recording email communications. This OS command injection flaw can be exploited without authentication and successful exploitation can lead to unauthorized access, privilege escalation, and potential compromise of the affected system’s integrity and confidentiality.Zimbra Collaboration (by Synacor) is a popular cloud-based collaboration software and email platform. The remote code execution vulnerability (CVE-2024-45519) in this software was disclosed on September 27, along with a proof of concept (PoC) exploit.What is the recommended Mitigation?Zimbra has released a patch for CVE-2024-45519. Organizations that haven’t implemented the latest patch are advised to do so immediately. https://blog.zimbra.com/2024/10/zimbra-cve-2024-45519-vulnerability-stay-secure-by-updating/ What FortiGuard Coverage is available?FortiGuard recommends users to apply the fix provided by the vendor. The FortiGuard Incident Response team can be engaged to help with any suspected compromise.The FortiGuard Labs team is further investigating to provide protections and will update this Threat Signal Report with more information once it becomes available.
p7zip-16.02-31.el8
Fix wrapper to hide password from process history
p7zip-16.02-31.el9
Fix wrapper to hide password from process history
p7zip-16.02-31.fc41
Fix wrapper to hide password from process history
p7zip-16.02-31.fc40
Fix wrapper to hide password from process history
p7zip-16.02-31.fc39
Fix wrapper to hide password from process history
Multiple security issues have been found in the Mozilla Firefox
web browser, which could potentially result in the execution
of arbitrary code.
Debian follows the extended support releases (ESR) of Firefox.
Starting with this update we’re now following the 128.x releases.
Between 115.x and 128.x, Firefox has seen a number of feature
updates. For more information please refer to
https://www.mozilla.org/en-US/firefox/128.0esr/releasenotes/
Fabian Vogt reported that the PAM module in oath-toolkit, a collection
of components to build one-time password authentication systems, does
not safely perform file operations in users’s home directories when
using the usersfile feature (allowing to place the OTP state in the home
directory of the to-be-authenticated user). A local user can take
advantage of this flaw for root privilege escalation.
