Read Time:5 Second
Microsoft has found that Russian APT Secret Blizzard piggybacks on other cybercriminals’ infr4asytructure to conduct cyber espionage
Monthly Archives: December 2024
python3.10-3.10.16-1.fc42
Read Time:22 Second
FEDORA-2024-39f0ccfbc3
Packages in this update:
python3.10-3.10.16-1.fc42
Update description:
Automatic update for python3.10-3.10.16-1.fc42.
Changelog
* Wed Dec 4 2024 Charalampos Stratakis <cstratak@redhat.com> – 3.10.16-1
– Update to 3.10.16
– Security fix for CVE-2024-9287
Resolves: rhbz#2321654
* Wed Sep 11 2024 Miro Hrončok <mhroncok@redhat.com> – 3.10.15-2
– Fix ThreadedVSOCKSocketStreamTest
Smashing Security podcast #396: Dishy DDoS dramas, and mining our minds for data
Read Time:20 Second
A CEO is arrested for turning satellite receivers into DDoS attack weapons! Then, we’ll journey into the world of bossware and “affective computing” and explore how AI is learning to read our emotions – is this the future of work, or a recipe for dystopia?
All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault.
G20 Leaders Fear Economic Over Cyber Risks
Read Time:5 Second
World Economic Forum data shows G20 executives are more concerned about economic risks that cyber-threats
UK’s NCA Disrupts Multibillion-Dollar Russian Money Launderers
Read Time:6 Second
The National Crime Agency has made scores of arrests in a bid to bring down two major Russian money laundering networks
ProjectSend Improper Authentication Vulnerability (CVE-2024-11680)
Read Time:1 Minute, 3 Second
What is the attack?ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application’s configuration. Successful exploitation allows attackers to create accounts, upload web shells, and embed malicious JavaScript. ProjectSend is a free, open-source software that lets you share files with your clients with privacy. CVE-2024-11680 has been added to CISA Known Exploited Catalog (KEV) on December 4, 2024.What is the recommended Mitigation?ProjectSend has released a patch for CVE-2024-11680. Organizations that have not implemented the latest patch are advised to do so immediately.According to VulnCheck, it found that only 1% of users were using the patched version of ProjectSend (r1750).Public exploits for CVE-2024-11680 are available, and since the exploitation is confirmed, companies must assess exposure, implement fixes and take appropriate action.What FortiGuard Coverage is available?FortiGuard recommends users to apply the patch and follow any mitigation steps provided by the vendor if not done already.The FortiGuard Incident Response team can be engaged to help with any suspected compromise.FortiGuard IPS protection is being reviewed to block any attack attempts related to CVE-2024-11680.
Pro-Russian Hacktivist Group Claims 6600 Attacks Targeting Europe
Read Time:7 Second
Orange Cyberdefense found that hacktivist gang Noname has almost exclusively targeted European countries since March 2022, with no attacks impacting the US
chromium-131.0.6778.108-1.fc41
Read Time:9 Second
FEDORA-2024-791faa660a
Packages in this update:
chromium-131.0.6778.108-1.fc41
Update description:
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.el10_0
Read Time:10 Second
FEDORA-EPEL-2024-60aa72a3e6
Packages in this update:
chromium-131.0.6778.108-1.el10_0
Update description:
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.el9
Read Time:9 Second
FEDORA-EPEL-2024-3ed223d8ce
Packages in this update:
chromium-131.0.6778.108-1.el9
Update description:
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8