article thumbnail

CVE-2024-27198, CVE-2024-27199: Two Authentication Bypass Vulnerabilities in JetBrains TeamCity

Tenable

Two vulnerabilities with publicly available exploit code in JetBrains TeamCity on-premises software could result in attackers bypassing authentication and achieving code execution. CVE Description CVSSv3 Severity CVE-2024-27198 Authentication bypass vulnerability 9.8 16 IPs seen scanning so far.

article thumbnail

Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)

Tenable

1 Critical 57 Important 1 Moderate 0 Low Microsoft addresses 59 CVEs in its May 2024 Patch Tuesday release with one critical vulnerability and three zero-day vulnerabilities, two of which were exploited in the wild. Researchers at Kaspersky have linked this zero-day vulnerability to QakBot and other malware. and is rated as important.

Windows 118
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Tenable

CVE Description CVSSv3 Severity CVE-2024-21762 Fortinet FortiOS Out-of-bound Write Vulnerability in sslvpnd 9.6 Medium FG-IR-23-397 Analysis CVE-2024-21762 is an out-of-bound write vulnerability in sslvpnd, the SSL VPN daemon in Fortinet FortiOS. FortiOS 6.0.0 (all all versions) Migrate to a newer version FortiOS 6.2 FortiOS 6.2.0

Malware 121
article thumbnail

‘SlashAndGrab’ ScreenConnect Vulnerability Widely Exploited for Malware Delivery

Ooda Loop

A critical vulnerability affecting ConnectWise’s ScreenConnect remote desktop access product has been exploited widely, leading to the delivery of ransomware and other malware. Dubbed SlashAndGrab […]

Malware 49
article thumbnail

CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

Tenable

As of January 31, there have been four CVEs disclosed by Ivanti throughout January 2024: CVE Description CVSSv3 Advisory CVE-2023-46805 Ivanti Connect Secure and Ivanti Policy Secure Authentication Bypass Vulnerability 8.2 CVE-2024-21893 can also be exploited without authentication, allowing for limited access to resources.

article thumbnail

Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action

Tenable

The attack against Microsoft began in November 2023, when Midnight Blizzard – also known as Nobelium, Cozy Bear and APT29 – compromised a legacy, non-production test account that lacked multi-factor authentication protection. What are your desired outcomes when it comes to implementing AI in your security team?

article thumbnail

Cybersecurity Snapshot: New Guide Details How To Use AI Securely, as CERT Honcho Tells CISOs To Sharpen AI Security Skills Pronto

Tenable

Plus, CERT’s director says AI is the top skill for CISOs to have in 2024. That’s the number one skill CISOs must acquire in 2024, according to Greg Touhill, Director of the CERT Division of Carnegie Mellon University’s Software Engineering Institute (SEI). Plus, the UK’s NCSC forecasts how AI will supercharge cyberattacks.