Security Affairs

APRIL 3, 2025

Ivanti addressed a critical remote code execution flaw in Connect Secure, which has been exploited since at least mid-March 2025. Ivanti released security updates to address a critical Connect Secure remote code execution vulnerability tracked as CVE-2025-22457. and earlier), Pulse Connect Secure 9.x

Security 168

Security Cybersecurity IT Information Security 168

The Last Watchdog

APRIL 16, 2025

16, 2025, CyberNewswire — SquareX researchers Jeswin Mathai and Audrey Adeline will be disclosing a new class of data exfiltration techniques at BSides San Francisco 2025. DLP is a core pillar of every enterprise security stack. She is also a published author of The Browser Security Field Manual.

Cloud 147

Cloud Ransomware Cybersecurity Data breaches 147

Security Affairs

JANUARY 31, 2025

Broadcom addressed the following vulnerabilities in VMware Aria Operations and Aria Operations for Logs: CVE-2025-22218 (CVSS score 8.5) CVE-2025-22219 (CVSS score: 6.8) CVE-2025-22220 (CVSS score: 4.3) – is a privilege escalationvulnerability. CVE-2025-22222 (CVSS score: 7.7) VMware Aria Operations Version 8.18.3

Authentication 262

Authentication Cloud Cybersecurity Access 262

Security Affairs

APRIL 5, 2025

The researchers Evan Connelly reported the flaw to Verizon on February 22, 2025, the vulnerability was addressed in mid-March. Since Cequints own website is down, concerns arise about how much user data this lesser-known company holdsand how securely it’s managed. ” warned the expert.

Metadata 243

Metadata Risk Passwords Authentication 243

Security Affairs

JANUARY 24, 2025

SonicWall is waring customers of a critical security vulnerability, tracked as CVE-2025-23006 (CVSS score of 9,8) impacting its Secure Mobile Access (SMA) 1000 Series appliances. Refer to the SMA1000 Administration Guide, section – Best Practices for Securing the Appliance.” ” reads the advisory.

Authentication 185

Authentication Access Passwords Security 185

Security Affairs

APRIL 18, 2025

ASUS warns of an authentication bypass vulnerability, tracked as CVE-2025-2492 (CVSS v4 score: 9.2), which impacts routers with AiCloud enabled. ” reads the ASUS Product Security Advisory. ” The Taiwanese multinational company recommends users to regularly check their devices and security settings to stay protected.

Authentication 283

Authentication Passwords Access Security 283

Security Affairs

APRIL 11, 2025

The security firm pointed out that no known vulnerability has been exploited, but monitoring and analysis continue. ” Recently, the threat intelligence firm GreyNoise reported a spike in login scanning targeting PAN-OS GlobalProtect portals starting March 17, 2025, peaking at 23,958 unique IPs. . ” concludes GreyNoise.

Passwords 238

Passwords Access Security IT 238

Security Affairs

JANUARY 24, 2025

Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SMA1000 vulnerability to its Known Exploited Vulnerabilities catalog. This week, SonicWall warned customers of a critical security vulnerability, tracked as CVE-2025-23006 (CVSS score of 9,8) impacting its Secure Mobile Access (SMA) 1000 Series appliances.

IT 228

IT Authentication Cybersecurity Access 228

Security Affairs

MARCH 12, 2025

Cybersecurity and Infrastructure Security Agency (CISA) adds six Microsoft Windowsflaws to its Known Exploited Vulnerabilities catalog. CVE-2025-24984 (CVSS 4.6): An NTFS information disclosure flaw that lets attackers with physical access and a malicious USB device read portions of heap memory. A few days ago, U.S.

IT 172

IT Cybersecurity Access Security 172

Security Affairs

APRIL 2, 2025

The three vulnerabilities are: CVE-2025-24085 (CVSS score: 7.3) – In January, Apple released security updates to address 2025s first zero-day vulnerability, tracked as CVE-2025-24085 , actively exploited in attacks targeting iPhone users. Apples USB Restricted Mode is a security feature introduced in iOS 11.4.1

Security 154

Security Access IT Information Security 154

Collaboration 2.0

APRIL 4, 2025

What makes a password strong in 2025? How long should it be, and how often should you update it? Here's the latest recommendations from top cybersecurity experts.

Passwords 243

Passwords Cybersecurity Security IT 243

Security Affairs

APRIL 16, 2025

The business services provider Conduent told the SEC a January cyberattack exposed personal data, including names and Social Security numbers. The business services provider Conduent revealed that personal information, including names and Social Security numbers, was stolen in a January cyberattack.

Data breaches 270

Data breaches Government Business Services Personal data 270

Security Affairs

MARCH 24, 2025

Medusa ransomware uses a malicious Windows driver ABYSSWORKER to disable security tools, making detection and mitigation more difficult. Elastic Security Labs tracked a financially driven MEDUSA ransomware campaign using a HEARTCRYPT-packed loader and a revoked certificate-signed driver, ABYSSWORKER, to disable EDR tools.

Ransomware 209

Ransomware Security IT Access 209

Security Affairs

JANUARY 15, 2025

Microsoft Patch Tuesday security updates for January 2025 addressed 161 vulnerabilities, including three actively exploited issues. ZDI researchers pointed out that this is the largest number of vulnerabilities addressed in by Microsoft montly security updates since 2017. are actively exploited in the wild.

Authentication 246

Authentication Security 246

Security Affairs

MARCH 13, 2025

GitLab released security updates to address critical vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The company addressed nine vulnerabilities, including the two critical ruby-saml authentication bypass issues respectively tracked as CVE-2025-25291 and CVE-2025-25292. GitLab CE/EE versions 17.7.7,

Authentication 172

Authentication Libraries Data breaches Security 172

Security Affairs

JANUARY 30, 2025

After responsible disclosure, DeepSeek promptly secured the issue. Researchers discovered two unusual open ports (8123 and 9000) on DeepSeek’s servers, which provided access to a publicly exposed ClickHouse database without authentication, raising significant security concerns. ” reads the report published by Wiz.

Metadata 304

Metadata Authentication Access Passwords 304

Security Affairs

MARCH 20, 2025

In March 2025, threat actors distributed archived messages through Signal. CERT-UA’s report states that the UAC-0200 activity has been tracked since summer 2024, with recent decoy messages (since February 2025) focusing on UAVs and electronic warfare.

Computer and Electronics 266

Computer and Electronics Archiving Passwords Government 266

Data Breach Today

OCTOBER 28, 2024

Forrester's Cody Scott on Why 2025 Will Be Pivotal for Security Leaders Forrester's 2025 Predictions for Cybersecurity, Risk and Privacy report forecasts that security leaders will scale back generative AI investments by 10%.

Privacy 225

Privacy Cybersecurity Risk Security 225

Security Affairs

MARCH 24, 2025

React framework addressed a critical vulnerability tracked as CVE-2025-29927 (CVSS score of 9.1) has been released to address a security vulnerability ( CVE-2025-29927 ). Maintainers of Next.js with the release of versions versions 12.3.5, 14.2.25, and 15.2.3. “Next.js version 15.2.3 ” reads the advisory.

Cybersecurity 177

Cybersecurity Risk Access Security 177

Security Affairs

JANUARY 30, 2025

TeamViewer released security patches for a high-severity elevation of privilege vulnerability, tracked as CVE-2025-0065 (CVSS score of 7.8), in its remote access solutions for Windows. TeamViewer has patched a high-severity privilege escalation vulnerability affecting its Windows client and host applications. for Windows.

Access 266

Access IT Security Information Security 266

Security Affairs

MARCH 5, 2025

The agency revealed that it has disconnected its infrastructure to contain the attack and secure data, a circumstance that suggests it was the victim of a ransomware attack. To secure data after the breach, POLSA’s network was immediately disconnected from the internet. “A cybersecurity incident has occurred at POLSA.

IT 244

IT Ransomware Cybersecurity Security 244

Security Affairs

APRIL 15, 2025

On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleos platform in October 2024 and December 2024.” Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability CVE-2024-50623 (CVSS score 8.8),which

Data breaches 163

Data breaches Ransomware Cybersecurity Government 163

Security Affairs

FEBRUARY 23, 2025

Every week the best security articles from Security Affairs are free in your email box. A new round of the weekly SecurityAffairs newsletter arrived! Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Lazarus APT stole $1.5B

Security 168

Security CMS Phishing Encryption 168

Security Affairs

FEBRUARY 23, 2025

Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Power Pages vulnerability to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Power Pages vulnerability, tracked as CVE-2025-24989 , to its Known Exploited Vulnerabilities (KEV) catalog.

IT 168

IT Cybersecurity Risk Access 168

Security Affairs

MARCH 20, 2025

Cybersecurity and Infrastructure Security Agency (CISA) adds Edimax IC-7100 IP Camera, NAKIVO,and SAP NetWeaver AS Java flaws to its Known Exploited Vulnerabilities catalog. Akamai researchers discovered the vulnerability, and the cyber security firm confirmed ([ 1 ],[ 2 ]) that the flaw is actively exploited in the wild.

IT 181

IT Cybersecurity Risk Security 181

Collaboration 2.0

MARCH 13, 2025

AI-powered cyber threats are reshaping security landscapes. Businesses that don't evolve will be vulnerable to increasingly sophisticated attacks - here's how to stay ahead.

Security 320

Security 320

Security Affairs

MARCH 31, 2025

Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Smart Licensing Utility flaw to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Smart Licensing Utility vulnerability, tracked as CVE-2024-20439 , to its Known Exploited Vulnerabilities (KEV) catalog.

IT 262

IT Cybersecurity Access Passwords 262

Security Affairs

FEBRUARY 6, 2025

Cisco addressed multiple vulnerabilities, including two critical remote code execution flaws, tracked as CVE-2025-20124 (CVSS score of 9.9) and CVE-2025-20125 (CVSS score of 9.1), in Identity Services Engine (ISE). “This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software.”

IT 183

IT Authentication Information Security Security 183

Security Affairs

APRIL 4, 2025

Experts disclosed a critical vulnerability, tracked as CVE-2025-30065 (CVSS score of 10.0), impacting Apache Parquet’s Java Library that could allow remote code execution “Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 The vulnerability CVE-2025-30065 is a Deserialization of Untrusted Data issue.

Libraries 172

Libraries Big data Risk Ransomware 172

Collaboration 2.0

NOVEMBER 19, 2024

Stung by last summer's CrowdStrike meltdown, which crashed Windows PCs and servers worldwide, Microsoft is rolling out a wide range of security changes to Windows. Here's what to expect over the next year

Security 273

Security 273

Security Affairs

APRIL 22, 2025

The Universal Subscriber Identity Module (USIM) is a smart card used in mobile devices, it securely stores subscriber information, including the International Mobile Subscriber Identity (IMSI) and cryptographic keys. The telecom giant detected an infection of its systems at 11 PM on Saturday, April 19, 2025. on Tuesday, April 22.

Risk 177

Risk Data breaches IoT Authentication 177

Collaboration 2.0

DECEMBER 23, 2024

AI arrived, security troubles were dodged, and after years of development, real-time Linux finally made it into mainstream Linux. Here's what shook up the open-source world this year and what it means for 2025.

Security 306

Security IT 306

Security Affairs

JANUARY 10, 2025

The cybersecurity firm discovered the campaign on January 7, 2025, the company discovered that threat actors used false offers of employment with CrowdStrike. “On January 7, 2025, CrowdStrike identified a phishing campaign exploiting its recruitment branding to deliver malware disguised as an “employee CRM application.”

Phishing 284

Phishing Mining Authentication Communications 284

Security Affairs

FEBRUARY 20, 2025

Microsoft has addressed two critical vulnerabilities, tracked as CVE-2025-21355 (CVSS score: 8.6) and CVE-2025-24989 (CVSS score: 8.2), respectively impacting Bing and Power Pages. The researcher Nicolas Joly reported the vulnerability.

Authentication 168

Authentication Access IT Information Security 168

The Last Watchdog

JANUARY 15, 2025

15, 2025, CyberNewswire — Aembit , the non-human identity and access management (IAM) company, unveiled the full agenda for NHIcon 2025, a virtual event dedicated to advancing non-human identity security, streaming live on Jan. Silver Spring, MD, Jan. 28 and headlined by industry luminary Kevin Mandia.

Security 130

Security Cloud Risk Access 130

Security Affairs

APRIL 12, 2025

Threat actors are exploiting a recently discovered vulnerability, tracked asCVE-2025-3102(CVSS score of 8.1) The researcherMichael Mazzolini discovered the vulnerabilityon March 13, 2025. on April 3, 2025. Threat actors are exploiting a vulnerability inthe OttoKitWordPress plugin, a few hours after public disclosure.

Authentication 185

Authentication Passwords Cybersecurity IT 185

Security Affairs

FEBRUARY 11, 2025

Microsoft Patch Tuesday security updates for February 2025 addressed four zero-day flaws, two of which are actively exploited in the wild. CVE-2025-21391 is a Windows Storage privilege escalation flaw exploited in the wild. ” CVE-2025-21418 is a Windows Ancillary Function Driver for WinSock privilege escalation flaw. .

Security 160

Security Passwords Authentication IT 160