ScanForge Security Digest 2615-01
SECURITY DIGEST SUMMARY This week presented a significant threat landscape with 43 critical vulnerabilities identified, though no actively exploited zero-days were added to CISA's catalog. Notable critical issues include authorization bypasses in ORY Oathkeeper, multiple vulnerabilities in CI4MS affecting access control and data validation, arbitrary code execution in NocoBase workflows, and SSL/TLS session protection weaknesses in Mbed TLS. Organizations should prioritize patching these critical vulnerabilities, particularly those affecting identity/access systems and no-code platforms. Concurrent threats include new macOS stealer campaigns, an emerging DDoS-for-hire botnet targeting IoT devices, and active exploitation of Ivanti EPMM requiring immediate federal remediation by Sunday.
Critical
43Security News
10A new campaign delivering the Atomic Stealer malware to macOS users abuses the Script Editor in a variation of the Click
CISA has given U.S. government agencies four days to secure their systems against a critical-severity vulnerability in I
Cybersecurity researchers have flagged a new variant ofmalware called Chaosthat'scapable of hitting misco
Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone und
Cybersecurity researchers have lifted the curtain on a stealthy botnet that's designed for distributed denial-of-service
Cyber-fraudsters move quickly from compromised devices to account takeover to funds transfer, shifting money before many
A total of seven vulnerabilities, most of which can be exploited for DoS attacks, have been patched in OpenSSL. The post