Resources
Learn about CYREBRO’s platform, technology, and capabilities, read about industry insights, watch webinars with cyber experts, and much more in the resources below.
-
Threat Intelligence
Critical WordPress “Elementor” Addons Plugin Site-Takeover Vulnerability
May 14, 2023 Critical WordPress “Elementor” Addons Plugin Site-Takeover Vulnerability ‘Essential Addons for Elementor’ has released patch for a critical vulnerability. Successful exploitation can allow an unauthenticated attacker to impersonate an administrator and completely take over a website without requiring any user interaction or social engineering. The Vulnerability CVE-2023-32243 (CVSS 3.1: 9.8, Critical) – Improper Authentication vulnerability…
-
Threat Intelligence
Ruckus RCE vulnerability exploits in the wild
May 10, 2023 Ruckus RCE vulnerability exploits in the wild Following the critical vulnerability in Ruckus Wireless Admin panels that was fixed on February 8, 2023. Exploitation of the vulnerability by a botnet named ‘AndoryuBot’ and remote code execution was observed. The Critical Vulnerability CVE-2023-25717 (CVSS 3.1: 9.1, Critical) Vulnerability in Ruckus Wireless Admin panels…
-
Threat Intelligence
SAP Patches Critical Vulnerabilitiy Affects SAP BusinessObjects Intelligence Platform
May 10, 2023 SAP Patches Critical Vulnerabilitiy Affects SAP BusinessObjects Intelligence Platform As part of May monthly security rollup updates, SAP has released patches to resolve several vulnerabilities which affect several SAP products including critical vulnerability affects SAP BusinessObjects Intelligence Platform. The Critical Vulnerability CVE-2023-28762 (CVSS 3.1: 9.1, Critical) -An Information Disclosure vulnerabilities in SAP…
-
Threat Intelligence
Cisco phone adapters vulnerable to RCE attacks
May 10, 2023 Cisco phone adapters vulnerable to RCE attacks Cisco has identified a vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters that allows an unauthenticated, remote attacker to execute arbitrary code on the devices. Since Cisco SPA112 2-Port Phone Adapters are unlikely to be connected to the Internet, these issues…
-
Threat Intelligence
Mozilla Patches RCE Vulnerabilities in Firefox & Firefox ESR
May 10, 2023 Mozilla Patches RCE Vulnerabilities in Firefox & Firefox ESR Mozilla has released security updates to address vulnerabilities in Firefox. An attacker could exploit these vulnerabilities to take control of an affected system. The RCE Vulnerabilities CVE-2023-32215 High severity – Memory corruption vulnerability, successful exploitation of which may allow a malicious actor to remotely run…
-
Threat Intelligence
Microsoft Patches Actively-Exploited 3 Zero-Days & 12 RCE Vulnerabilities
May 10, 2023 Microsoft Patches Actively-Exploited 3 Zero-Days & 12 RCE Vulnerabilities As part of May monthly security rollup updates, Microsoft has patched 3 Zero-Day and 12 Remote Code Execution (RCE) vulnerabilities. Overall, Microsoft has patched 40 vulnerabilities across Windows, VS, Edge, Office, RDP and others. The Zero-Day Vulnerabilities CVE-2023-29336, (CVSS 3.1: 7.8, High-Severity) –…
-
Threat Intelligence
Critical RCE Vulnerability in Linux Kernel
May 10, 2023 Critical RCE Vulnerability in Linux Kernel A novel Linux NetFilter kernel use-after-free vulnerability has been discovered, allows unprivileged local users to escalate their privileges to root level and perform code execution, and potentially total control over a machine. The Vulnerability CVE-2023-32233 – An use-after-free in Netfilter nf_tables when processing batch requests, allows…
-
Threat Intelligence
Service Location Protocol (SLP) Vulnerability Affecting Various Products
April 27, 2023 Service Location Protocol (SLP) Vulnerability Affecting Various Products Researchers discovered a new vulnerability in the Service Location Protocol (SLP). SLP is a protocol created to provide configuration for local area networks. Using SLP, a system registers itself with a directory agent, which makes its services available to other systems. Daemons providing SLP…
-
Threat Intelligence
INEA Patches Vulnerability in ME RTU
April 27, 2023 INEA Patches Vulnerability in ME RTU INEA issued a security advisory regarding OS Command Injection vulnerability in ME RTU (Remote Terminal Unit). The Critical Vulnerability CVE-2023-2131 (CVSS 3.1: 10, Critical) – OS Command Injection Vulnerability. Successful exploit of this vulnerability could allow a threat actor to remotely execute arbitrary code. Affected Products…
-
Threat Intelligence
Apache Superset Patches Vulnerability Caused by Insecure Default Configuration Exposes Servers to RCE
April 27, 2023 Apache Superset Patches Vulnerability Caused by Insecure Default Configuration Exposes Servers to RCE Apache Superset, which is an open source data visualization and exploration tool software, has been found vulnerable to authentication bypass and remote code execution due to usage of its default configurations. This allows attackers to potentially access and modify…
-
Threat Intelligence
VMware Patches Vulnerabilities in Workstation and Fusion Software
April 27, 2023 VMware Patches Vulnerabilities in Workstation and Fusion Software VMware issued a security advisory regarding four vulnerabilities affecting VMware Workstation and Fusion software, The critical one among them could allow a local attacker to carry out code execution. The Critical Vulnerability CVE-2023-20869 (CVSS 3.1: 9.3, Critical) – Stack-based buffer-overflow vulnerability. Successful exploit of…
-
Threat Intelligence
Microsoft Patches Zero-Day Privilege Escalation Vulnerability in Windows
April 27, 2023 Microsoft Patches Zero-Day Privilege Escalation Vulnerability in Windows Microsoft has patched a zero-day privilege escalation vulnerability in win32kfull driver, which caused by a failure to validate an object’s existence before performing operations on it. The Critical Vulnerability CVE-2022-24542 (CVSS 3.1: 8.8, High) – Privilege Escalation Vulnerability. Successful exploit of this vulnerability allows a…