Shows
Daily Security ReviewCVE-2025-54309: CrushFTP Zero-Day Exploited in Global Admin Access AttacksA critical zero-day vulnerability in CrushFTP (CVE-2025-54309) is being actively exploited, giving attackers administrative access to over a thousand unpatched servers globally. This severe security flaw—caused by improper validation in the AS2 protocol—has exposed enterprise-managed file transfer (MFT) systems across the US, Europe, and Canada. Security experts are sounding the alarm, and organizations relying on CrushFTP are urged to patch immediately.Discovered in mid-July 2025, the bug has been traced to reverse-engineering of recent CrushFTP patches. The vulnerability grants unauthenticated attackers complete control via exposed web interfaces, making it a high-value exploit for data theft, surv...2025-07-2222 min
CYFIRMA ResearchCYFIRMA Research: CVE-2025-5777– Pre-Auth Memory Leak in Citrix NetScaler (CitrixBleed 2)Critical Alert: CVE-2025-5777 – Pre-Auth Memory Leak in Citrix NetScaler (CitrixBleed 2)!Organizations relying on Citrix NetScaler ADC and Gateway for secure remote access must act immediately. This newly uncovered vulnerability allows unauthenticated attackers to leak sensitive memory—including session tokens—by sending malformed authentication requests.Exploited in the wild and backed by public PoC code, this flaw enables session hijacking, MFA bypass, and potential lateral movement inside enterprise networks. Given its low complexity and global attack surface, CVE-2025-5777 is a high-priority threat for critical sectors like government, finance, and telecom.Apply patches, terminate active...2025-07-2105 min
Daily Security ReviewCitrixBleed Returns: CVE-2025-5777 and the Exploitation of NetScaler DevicesIn this episode, we dissect CitrixBleed 2—a newly disclosed and actively exploited vulnerability affecting Citrix NetScaler ADC and Gateway appliances. Tracked as CVE-2025-5777 (and possibly also CVE-2025-6543), this critical flaw mirrors the notorious original CitrixBleed by allowing attackers to extract sensitive memory content, including user session tokens, through crafted POST login requests.Despite Citrix’s claims that there’s no active exploitation, threat intelligence reports from security researchers and government agencies like CISA tell a different story: public proof-of-concept exploits are circulating, and attacks have been observed as early as mid-June. The vulnerability stems from a form...2025-07-081h 02
Daily Security ReviewCISA Flags CVE-2025-6554: Patching Chrome’s Critical Flaw Before It’s Too LateA newly discovered and actively exploited zero-day vulnerability in Google Chrome has sent ripples through the cybersecurity community. Known as CVE-2025-6554, this critical type confusion flaw in Chrome’s V8 JavaScript and WebAssembly engine enables remote attackers to perform arbitrary read/write operations or execute code via a single malicious webpage. With active exploitation confirmed and inclusion in CISA’s Known Exploited Vulnerabilities catalog, organizations are under urgent pressure to patch all affected systems—immediately.In this episode, we break down what makes this vulnerability especially dangerous, why Google’s Threat Analysis Group (TAG) is paying close at...2025-07-0740 min
Daily Security ReviewCVE-2025-20309: Critical Cisco Root Access Flaw Threatens VoIP SecurityA devastating vulnerability—CVE-2025-20309—has been discovered in Cisco’s Unified Communications Manager (Unified CM) and its Session Management Edition (SME), threatening the security of over a thousand internet-exposed VoIP systems globally. In this episode, we break down this critical flaw, which scores a perfect CVSS 10.0, and explore why it's one of the most dangerous telecom vulnerabilities in recent memory.The vulnerability stems from unchangeable hardcoded SSH root credentials inadvertently left in production code during development. Exploitable without authentication, this flaw grants remote attackers full root access to affected systems—an open door to full system takeover...2025-07-0441 min
Daily Security ReviewCISA Flags Citrix NetScaler Flaws: What CVE-2025-6543 Means for Federal and Private NetworksThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog—an urgent signal for federal agencies and private enterprises alike. At the center of this update is CVE-2025-6543, a memory overflow flaw affecting NetScaler ADC and Gateway appliances, which could lead to Denial of Service attacks under specific configurations. This joins earlier additions from 2023, including CVE-2023-6548 and CVE-2023-6549, covering code injection and buffer overflow vulnerabilities.In this episode, we explore why NetScaler vulnerabilities are drawing heightened attention, how they are actively being ex...2025-07-0156 min
IT SPARC CastTwo New Linux Privilege Escalation Flaws You Need to Patch (CVE-2025-6018 & CVE-2025-6019)In this episode of IT SPARC Cast - CVE of The Week, John and Lou break down two critical Linux vulnerabilities—CVE-2025-6018 and CVE-2025-6019—that could allow local users to escalate privileges all the way to root. Discovered by the Qualys Threat Research Unit, these flaws affect major Linux distributions, including openSUSE and SUSE Enterprise Linux. Even though Ubuntu users may be safe if default PAM files haven’t been altered, the risks for production Linux environments are real—and patching is essential.We dive into how attackers could chain these flaws together to gain una...2025-07-0104 min
Daily Security ReviewCitrix NetScaler Flaws Expose Enterprise Networks: CVE-2025-5349 & CVE-2025-5777Two newly disclosed critical vulnerabilities—CVE-2025-5349 and CVE-2025-5777—have put Citrix NetScaler ADC and Gateway deployments at serious risk, exposing enterprise environments to potential data breaches and service disruptions. These flaws underscore the persistent challenges facing infrastructure teams, especially when balancing security patching with service availability.We dive deep into: 🔍 The technical mechanisms behind the NetScaler vulnerabilities and why they’re considered high risk ⚙️ The real-world difficulties of patching Citrix environments, including long installation times, session disruption concerns, and HA strategy failures 🛠️ Staged patching techniques, including gold image refresh for MCS, traffic redirection using VI...2025-06-2038 min
Daily Security ReviewGerriScary: How CVE-2025-1568 Threatened Google’s Open-Source Supply ChainCVE-2025-1568, dubbed "GerriScary", has shaken the open-source ecosystem by exposing a fundamental weakness in Google’s Gerrit code review system—one that could have enabled attackers to infiltrate 18 of Google’s most widely used open-source projects, including Chromium, ChromiumOS, Dart, and Bazel.This episode breaks down how the vulnerability was discovered by researchers at Tenable using a subtle but powerful HTTP status code fingerprinting technique. A simple 209 response exposed whether a user had the “addPatchSet” permission on a given project. That small indicator opened the door to a potentially massive software supply chain compromise, allowing malicious patchsets...2025-06-1935 min
Daily Security ReviewChrome's New Vulnerability CVE-2025-4664: A Security Flaw That Can Lead to Account TakeoverIn this episode, we take an in-depth look at the newly discovered CVE-2025-4664 vulnerability in Google Chrome’s Loader component. This high-severity security flaw is affecting not only Chrome but also other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi. The issue lies in insufficient policy enforcement within the browser’s Loader, enabling attackers to manipulate the referrer-policy and leak sensitive cross-origin data, potentially leading to full account takeovers.We discuss the technical details of the exploit, focusing on how attackers leverage the Link header to set the referrer-policy to unsafe-url, thus capturing full URLs with...2025-05-1609 min
Seemposium PodcastSeemposium lowlevel_3 | CVE nel caos e LLM che ragionano davvero?In questo nuovo episodio, Andrea e Gabriele analizzano le vulnerabilità più critiche delle ultime settimane, tra cui il caso SAP e la gestione disastrosa del supporto VPN in casa Fortinet. A fare da sfondo, il caos nel progetto CVE del Mitre, che rischia di mettere in crisi l’intero sistema di classificazione delle vulnerabilità.La discussione si allarga poi al futuro della sicurezza informatica con AI: l’intelligenza artificiale può davvero “ragionare”? Le ultime ricerche di Anthropic suggeriscono di sì. Ma quali sono i rischi, i bias, e le derive distopiche dietro l’adozione di questi sistemi anche in ambito...2025-05-091h 20
AppSec NowTackling CVE Chaos, Parquet Tool Insights, and EU Cyber Resilience Act Unpacked🔒 Welcome to this week’s episode of AppSecNow, the DevCentral podcast dedicated to all things application security! 🚨 This week, we unpack critical updates including:💥 A zero-day SAP CVE with a CVSS score of 10—what it means, how it's being exploited, and what you can do to defend against it.🛠️ A groundbreaking Parquet tool from F5 Labs that simplifies vulnerability testing for critical supply chain security issues.Link: https://github.com/F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065🌍 The EU Cyber Resilience Act—what it means for manufacturers, open-source stewards, and secure-by-design initiatives.Learn how AppSec professional...2025-04-2830 min
DevCentralTackling CVE Chaos, Parquet Tool Insights, and EU Cyber Resilience Act Unpacked🔒 Welcome to this week’s episode of AppSecNow, the DevCentral podcast dedicated to all things application security! 🚨 This week, we unpack critical updates including:
💥 A zero-day SAP CVE with a CVSS score of 10—what it means, how it's being exploited, and what you can do to defend against it.
🛠️ A groundbreaking Parquet tool from F5 Labs that simplifies vulnerability testing for critical supply chain security issues.
Link: https://github.com/F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065
🌍 The EU Cyber Resilience Act—what it means for manufacturers, open-source stewards, and secure-by-design initiatives.
Learn how AppSec professionals leverage cutting-edge tools and protocols to tackle some of the biggest cha...2025-04-2830 min
Shared Security PodcastThe Impact of Politics on Cybersecurity: CVE’s and the Chris Krebs Executive OrderWhat would happen if the US government halted funding for the CVE program? In this episode, we explore the controversies surrounding the funding of the CVE program, the role of CVEs in the cybersecurity industry, and the recent launch of the CVE Foundation. We also discuss the Trump Administration’s executive order that revoked the security […]
The post The Impact of Politics on Cybersecurity: CVE’s and the Chris Krebs Executive Order appeared first on Shared Security Podcast.2025-04-2820 min
Shared SecurityThe Impact of Politics on Cybersecurity: CVE’s and the Chris Krebs Executive OrderWhat would happen if the US government halted funding for the CVE program? In this episode, we explore the controversies surrounding the funding of the CVE program, the role of CVEs in the cybersecurity industry, and the recent launch of the CVE Foundation. We also discuss the Trump Administration's executive order that revoked the security clearance of former CISA Director Chris Krebs, following his declaration that the 2020 election was the most secure in history. Join us as we unpack the impact of these events on the cybersecurity landscape and what it means for the future. Show notes...2025-04-2820 min
🔴 RadioCSIRT : L’Actu Cyber Qui Protège Votre Quotidien ! ⚡️RadioCSIRT : Le Programme CVE confirmé et renforcé ! - Épisode Spécial 268🔴 Breaking News Cybersécurité 🔴
Le Programme CVE, pilier mondial de la gestion des vulnérabilités, n’a jamais été menacé !
📌 Au programme aujourd’hui :
🔹 Clarification officielle de la CISA
Matt Hartman, Directeur exécutif adjoint par intérim de la CISA, réaffirme que le programme CVE n’a connu aucune interruption. Pas de problème de financement, seulement un dossier contractuel réglé à temps.
📚 Source : https://www.cisa.gov/news-events/news/statement-matt-hartman-cve-program
🔹 Soutien total de la CVE Foundation
La CVE Foundation confirme son alignement avec CISA et annonce sa volonté de soutenir une tra...2025-04-2406 min
OT After HoursTo CVE or Not to CVE?In this episode, we explore how often OT teams really need to refresh asset-inventory data and what MITRE’s near-miss funding lapse for the CVE program means for vulnerability management. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Natalie Kalinowski (OT Security Specialist), Lance Lamont (Team Lead, Special Projects & Protocols), Andrew Wintermeyer (Senior ICS Architect), and Tyler Bergman (Principal Security Consultant) as they discuss scan cadences, change-detection value, and building redundancy into threat-intel pipelines. Key Takeaways Context drives cadence. Fan speed may need minute-level polling, firmware often does not. Re...2025-04-2346 min
Storm Watch by GreyNoise IntelligenceCVE Chaos: The Fragmented Future of Vulnerability Tracking, Bad Bots & Real-Time Threat Intel Forecast = Prepare for scattered CVEs, rising bot storms, and real-time threat lightning. Keep your digital umbrellas handy! On this episode of Storm⚡️Watch, we’re breaking down the latest shifts in the vulnerability tracking landscape, starting with the ongoing turbulence in the CVE program. As the MITRE-run CVE system faces funding uncertainty and a potential transition to nonprofit status, the global security community is rapidly adapting. New standards and databases are emerging to fill the gaps—Europe’s ENISA is rolling out the EU Vulnerability Database to ensure regional control, while China continues to operate its own stat...2025-04-2256 min
Techzine TalksHoe erg is het als de MITRE CVE-database verdwijnt?Het kwam vorige week als donderslag bij heldere hemel. Een dag voor het verstrijken van de deadline van 16 april werd duidelijk dat er nog geen nieuwe fondsen beschikbaar gesteld waren door de Amerikaanse overheid voor de CVE-database van de MITRE Corporation. Te elfder ure kwam het toch nog goed. Voor nu althans, want wie weet hoe het over elf maanden gaat, als de nieuwe termijn afloopt. Hoe moeten we deze gang van zaken interpreteren? En wat kunnen we doen om een herhaling van de toch wel paniekerige reacties vorige week te voorkomen? We bespreken het in de nieuwste...2025-04-2224 min
GitHub Daily TrendGitHub - CVEProject/cvelistV5: CVE cache of the official CVE List in CVE JSON 5 formathttps://github.com/CVEProject/cvelistV5 CVE cache of the official CVE List in CVE JSON 5 format - CVEProject/cvelistV5 Powered by VoiceFeed. https://voicefeed.web.app/lp/podcast?utm_source=githubtrenddaily&utm_medium=podcast Developer:https://twitter.com/_horotter2025-04-2004 min
Breach FM - der Infosec PodcastFlurfunk - Ende der CVE Datenbank?Diese Woche bei Breach FM: Max Imbiel und Robert Wortmann tauchen in die Welt der Cyber-Security ein – von Wellness-Wanderungen bis zu globalen Datenbank-Dramen! Hier ein Blick auf unsere Themen:👉 Chris Krebs im Fokus: Der ehemalige CISA-Direktor verliert seine Security Clearance und tritt bei SentinelOne zurück, um die Firma zu schützen. Ein persönlicher Kampf gegen politische Machtspiele? Wir diskutieren, warum Krebs ein Vorbild für die Branche bleibt.👉 CVE-Datenbank in Aufruhr: Die Security-Welt gerät in Aufregung, als das Funding für das CVE-Programm kurzzeitig zu kippen droht. Was steckt genau hinter dieser Krise und wie...2025-04-191h 04
El Negocio de la TecnologíaPrograma CVE Salvado, Nombramiento de CISA Bloqueado, Modelos de IA de OpenAI Lanzados, SolarWinds se Vuelve PrivadoEl gobierno de EE. UU. ha renovado la financiación del Programa de Exposición y Vulnerabilidades Comunes (CVE), una base de datos crítica para rastrear fallos de ciberseguridad, justo horas antes de que su financiación estuviera a punto de expirar. Establecido hace 25 años, el programa CVE asigna identificadores únicos a las vulnerabilidades de seguridad, facilitando la comunicación consistente en el panorama de la ciberseguridad. La renovación de la financiación se produce en medio de preocupaciones de que, sin ella, nuevas vulnerabilidades podrían no ser rastreadas, lo que representa riesgos para la seguridad...2025-04-1716 min
SANS Internet Storm Center's Daily Network Security News PodcastSANS Stormcast Thursday April 17th: Apple Updates; Oracle Updates; Google Chrome Updates; CVE News; (#)SANS Stormcast Thursday April 17th: Apple Updates; Oracle Updates; Google Chrome Updates; CVE News; Apple Updates Apple released updates for iOS, iPadOS, macOS, and VisionOS. The updates fix two vulnerabilities which had already been exploited against iOS. https://isc.sans.edu/diary/Apple%20Patches%20Exploited%20Vulnerability/31866 Oracle Updates Oracle released it quarterly critical patch update. The update addresses 378 security vulnerabilities. Many of the critical updates are already known vulnerabilities in open-source software like Apache and Nginx ingress. https://www.oracle.com/security-alerts/cpuapr2025.html Oracle Breach Guidance CISA released guidance for users affected by the recent Oracle cloud breach. The...2025-04-1706 min
CyberWire DailyCVE program gets last-minute lifeline.The CVE program gets a last-minute reprieve. A federal whistleblower alleges a security breach at the NLRB. Texas votes to spin up their very own Cyber Command. BreachForums suffers another takedown. A watchdog group sues the federal government over SignalGate allegations. The SEC Chair reveals a 2016 hack. ResolverRAT targets the healthcare and pharmaceutical sectors worldwide. Microsoft warns of blue screen crashes following recent updates. On our CertByte segment, Chris Hare is joined by Troy McMillan to break down a question targeting the EC-Council® Certified Ethical Hacker (CEH) exam. 4chan gets Soyjacked. Remember to leave us a 5-star ra...2025-04-1633 min
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)SANS Stormcast Wednesday Apr 16th: File Upload Service Abuse; OpenSSH 10.0 Released; Apache Roller Vuln; Possible CVE Changes
Online Services Again Abused to Exfiltrate Data
Attackers like to abuse free online services that can be used to exfiltrate data. From the originals , like pastebin,
to past favorites like anonfiles.com. The latest example is gofile.io. As a defender, it is important to track these services to detect exfiltration early
https://isc.sans.edu/diary/Online%20Services%20Again%20Abused%20to%20Exfiltrate%20Data/31862
OpenSSH 10.0 Released
OpenSSH 10.0 was released. This release adds quantum-safe ciphers and the separation of authentication services into a separate binary to reduce the authentication attack surface.
https://www.openssh...2025-04-1605 min
SANS Stormcast: Daily Cyber Security NewsSANS Stormcast Wednesday Apr 16th: File Upload Service Abuse; OpenSSH 10.0 Released; Apache Roller Vuln; Possible CVE Changes Online Services Again Abused to Exfiltrate Data Attackers like to abuse free online services that can be used to exfiltrate data. From the originals , like pastebin, to past favorites like anonfiles.com. The latest example is gofile.io. As a defender, it is important to track these services to detect exfiltration earlyhttps://isc.sans.edu/diary/Online%20Services%20Again%20Abused%20to%20Exfiltrate%20Data/31862 OpenSSH 10.0 Released OpenSSH 10.0 was released. This release adds quantum-safe ciphers and the separation of authentication services into a separate binary to reduce the authentication attack surface.https://www.openssh...2025-04-1605 minSANS Internet Storm Center's Daily Network Security News PodcastSANS Stormcast Wednesday Apr 16th: File Upload Service Abuse; OpenSSH 10.0 Released; Apache Roller Vuln; Possible CVE Changes (#)SANS Stormcast Wednesday Apr 16th: File Upload Service Abuse; OpenSSH 10.0 Released; Apache Roller Vuln; Possible CVE Changes Online Services Again Abused to Exfiltrate Data Attackers like to abuse free online services that can be used to exfiltrate data. From the “originals”, like pastebin, to past favorites like anonfiles.com. The latest example is gofile.io. As a defender, it is important to track these services to detect exfiltration early https://isc.sans.edu/diary/Online%20Services%20Again%20Abused%20to%20Exfiltrate%20Data/31862 OpenSSH 10.0 Released OpenSSH 10.0 was released. This release adds quantum-safe ciphers and the separation of authentication services into a separate bina...2025-04-1605 min
VulnVibes[VULN] - Xerox Versalink Printers Vulnerable to Pass-Back Attacks - CVE-2024-12510 & CVE-2024-12511Researchers at Rapid7 have identified vulnerabilities in Xerox Versalink C7025 multifunction printers that could enable attackers to steal user credentials. Tracked as CVE-2024-12510 and CVE-2024-12511, these flaws facilitate a "pass-back attack," in which the printer is deceived into returning authentication data to the attacker.2025-02-1905 minVulnVibes[VULN] - OpenSSH Client & Server Vulnerabilities Allow MiTM and DoS Attacks - CVE-2025-26465 & CVE-2025-26466The Qualys Threat Research Unit (TRU) has revealed two newly discovered vulnerabilities in OpenSSH, impacting both clients and servers. Designated as CVE-2025-26465 and CVE-2025-26466, these flaws could allow attackers to carry out machine-in-the-middle (MITM) attacks and denial-of-service (DoS) exploits.2025-02-1904 minVulnVibes[VULN] - Cisco ISE Critical vulnerabilities - CVE-2025-20124 & CVE-2025-20125Cisco has released a security advisory regarding two critical vulnerabilities in its Identity Services Engine (ISE), a widely used network security policy management platform. These vulnerabilities, identified as CVE-2025-20124 and CVE-2025-20125, could allow authenticated attackers to execute arbitrary commands with root privileges and bypass authorization controls, posing significant risks to affected systems.2025-02-0904 min
We Speak CVE25 Years of CVE and What’s NextHost Shannon Sabens speaks with fellow CVE Board members Kent Landfield and Madison Oliver and CVE Program Lead Alec Summers about the 25th anniversary of the CVE Program. Topics include the history of the program, the program today, and what’s next.2025-02-0447 minVulnVibes[VULN] - Multiple security flaws in SimpleHelp - CVE-2024-57727&&CVE-2024-57728&&CVE-2024-57726CVE-2024-57727&&CVE-2024-57728&&CVE-2024-57726 : Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks2025-01-1604 min
Below the Surface (Audio) - The Supply Chain Security PodcastCVE Turns 25In this episode, Paul Asidorian, Alec Summers, and Lisa Olson discuss the 25th anniversary of the CVE program, its evolution, and the importance of transparency in vulnerability management. They explore the history of CVE, the process of creating CVE records, and the role of CNAs in ensuring accountability. The conversation also addresses challenges related to end-of-life software vulnerabilities and the need for maintaining the integrity of CVE records in an ever-evolving cybersecurity landscape. In this conversation, the speakers discuss the complexities of managing and analyzing vulnerabilities in software, mainly focusing on the roles of CVE and CVSS in providing...2024-12-091h 02CYFIRMA ResearchCYFIRMA Research: CVE-2024-7479 and CVE-2024-7481- Privilege Escalation - Vulnerability Analysis and ExploitationCritical Alert: Organizations using TeamViewer's Remote Client and Remote Host products on Windows must act now!CVE-2024-7479 and CVE-2024-7481 present a severe risk of privilege escalation. With millions of users potentially affected globally, immediate action is crucial. Both flaws involve improper cryptographic signature verification during driver installation. Specifically, CVE-2024-7479 pertains to VPN drivers, while CVE-2024-7481 relates to printer drivers. These vulnerabilities allow local, unprivileged attackers to escalate their privileges by exploiting TeamViewer's installation process and loading malicious drivers onto the system. Users should update to version 15.58.4 or later to mitigate this risk, check...2024-11-0603 minWe Speak CVECNA Onboarding Process Myths Versus FactsShannon Sabens of CrowdStrike chats with Dave Morse, program coordination lead for the CVE Program, about the myths and facts of the CVE Numbering Authority (CNA) partner onboarding process. Truth and facts about the following topics are discussed: duration and complexity of the onboarding process; the fact that there is no fee to participate; ease of incorporating assigning CVE Identifiers (CVE IDs) and publishing CVE Records into an organization’s existing coordinated vulnerability disclosure (CVD) processes; availability of automated tools for CNAs; the CVE JSON Record format and available guidance; role of Roots and Top-Level Roots and ho...2024-10-0124 minCYFIRMA ResearchCYFIRMA Research- CVE-2024-40725 and CVE-2024-40898 Vulnerabilities in Apache’s HTTP Server: Vulnerability Analysis and ExploitationCVE-2024-40725 and CVE-2024-40898 are critical vulnerabilities in Apache’s HTTP Server. CVE-2024-40725 affects the mod_proxy module and enables HTTP Request Smuggling attacks, while CVE-2024-40898 allows authentication bypass due to improper SSL configuration. With widespread exposure, these vulnerabilities pose severe risks globally. Immediate patching is crucial to safeguard sensitive systems from potential exploitation.Link to the Research Report: CVE-2024-40725 and CVE-2024-40898 Vulnerabilities in Apache’s HTTP Server : Vulnerability Analysis and Exploitation - CYFIRMA #CyberSecurity #ApacheVulnerabilities #CVE202440725 #CVE202440898 #PatchNow #InfoSec #CyberThreats #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLMhttps://www.cyfirma.com/2024-09-1603 minWe Speak CVEExpected Impact of the CNA Rules 4.0Host Shannon Sabens speaks with Art Manion and Kent Landfield, all three of whom are CVE Board members and CVE Working Group (WG) chairs, about the all-new “CVE® Numbering Authority (CNA) Operational Rules Version 4.0.” Topics discussed include the new fundamental concept embedded throughout the rules called the “right of refusal”; how CVE assignment is technology neutral (i.e., cloud, artificial intelligence, etc.); end-of-life assignments; the dispute process; how CNAs can add additional data to their CVE Records such as CVSS, CWE, and CPE information at the time of disclosure for use by downstream consumers; and the expected positive i...2024-05-2137 minCYFIRMA ResearchCYFIRMA Research - Emerging Security Threats: Analysis of CVE-2024-3400Palo Alto Networks has uncovered CVE-2024-3400, a critical vulnerability exploited by threat actor 'UTA0218' in a sophisticated two-stage attack. This flaw allows unauthorized command execution on vulnerable PAN-OS devices via a backdoor mechanism.Adding to the urgency, CISA has promptly listed CVE-2024-3400 in its Known Exploited Vulnerabilities catalogue. The risk of data breaches is high, with reports of sensitive data for sale on underground forums. Stay vigilant and safeguardyour digital assets! Link to the Research Report: Emerging Security Threats : Analysis of CVE-2024-3400 - CYFIRMA#Cybersecurity #ThreatAlert #CVE20243400 #Pa...2024-05-0903 min
Threat Talks - Your Gateway to Cybersecurity InsightsPalo Alto Networks CVE-2024-3400: a comprehensive analysis of the vulnerabilityTune into this special episode of Threat Talks, as we dissect the critical CVE 2024 3400 vulnerability in Palo Alto Networks' GlobalProtect servers.
Join our cybersecurity experts for a deep dive into the vulnerability's implications, our response strategies, and practical tips to bolster your defenses against similar threats.
For those who crave even more detailed insights, be sure to check out our comprehensive information page on this topic: https://on2it.net/nl/cve-2024-3400-pan-os-os-command-injection-vulnerability-in-globalprotect/
And read our blog posts for a deeper dive into the technical aspects and implications of...2024-05-0740 minWe Speak CVESwimming in Vulns (or, Fun with CVE Data Analysis)Host Shannon Sabens of CrowdStrike chats with Benjamin Edwards and Sander Vinberg, both of Bitsight, about analyzing vulnerability data in the CVE List. This is a follow-on to their “CVE Is The Worst Vulnerability Framework (Except For All The Others)” talk at CVE/FIRST VulnCon 2024.Topics discussed include the types of vulnerabilities and vulnerability intelligence they reviewed and the different ways they approached the data; how CVE is a really good framework for compiling information about, and communicating effectively about, vulnerabilities; how increasing the number of CVE Numbering Authorities (CNAs) through federation has improved the quantity and qual...2024-04-2943 min
Chaos Lever PodcastWhen Code Goes Rogue: The CVE-2024-3094 SagaNed and Chris discuss the impact of a sophisticated cybersecurity vulnerability, CVE-2024-3094, found in xz compression software by a Microsoft employee.CVE-2024-3094In this Chaos Lever episode, Ned and Chris look into the shadowy depths of cybersecurity where a malicious code, CVE-2024-3094, lurks within the seemingly benign xz compression software. This problem was deliberately created by someone with harmful intentions and essentially allows hackers to sneakily access and manipulate data in systems using this software. Ned and Chris uncover how this exploit could give hackers unfettered access to Linux systems worldwide...2024-04-1135 minWe Speak CVEMeet the 3 New CVE Board MembersIn this episode — recorded live at “CVE/FIRST VulnCon 2024” — CVE Board member and CVE podcast host Shannon Sabens of CrowdStrike chats with the three newest CVE Board members: Madison Oliver of GitHub Security Lab, Tod Beardsley of Austin Hackers Anonymous (AHA!), and MegaZone of F5 who joins as the new CVE Numbering Authority (CNA) Liaison to the Board.Topics include how and why each new member joined the board, the impact that participating in CVE Working Groups had on their decisions to become Board me...2024-04-0925 minCYFIRMA ResearchCYFIRMA Research - Vulnerability Analysis and Exploitation: Understanding CVE-2024-27198 in JetBrains TeamCityOur latest report sheds light on CVE-2024-27198, a severe vulnerability that has been exploited for unauthorized admin access and privilege escalation in JetBrains TeamCity, marked by CISA on March 7, 2024, as a significant threat. This breach has led to Jasmin ransomware attacks and unauthorized user setups, linked to the BianLian and Jasmin families. The Shadowserver Foundation's dashboard reports nearly 500 devices are still at risk, with our investigations uncovering 241 publicly accessible, vulnerable instances. The engagement of North Korean group Kimsuki and others in exploiting this vulnerability underscores the pressing need for comprehensive security measures and awareness among cybersecurity communities.2024-04-0905 minWe Speak CVECVE Records States and TagsHost Shannon Sabens speaks with Art Manion and Kent Landfield, all three of whom are CVE Board members and CVE Working Group (WG) chairs, about CVE Records. Discussion topics include the CVE Record Lifecycle, the three “states” of CVE Records (RESERVED, PUBLISHED, and REJECTED), the current “tags” in use with CVE Records (EXCLUSIVELY-HOSTED-SERVICE; UNSUPPORTED-WHEN-ASSIGNED; and DISPUTED), the difference between the REJECTED state and the DISPUTED tag, how a DISPUTED tag can be temporary or indefinite, and much more. 2024-03-2633 minCYFIRMA ResearchCYFIRMA Research - FortiOS/FortiProxy (CVE-2024-21762)- Vulnerability Analysis and ExploitationA critical vulnerability, CVE-2024-21762, has been identified in Fortinet's FortiOS/FortiProxy, posing a severe global threat to digital security. CYFIRMA researchers have conducted an exhaustive analysis of the vulnerability. Immediate action is strongly advised. Apply the latest patches provided by Fortinet to secure your systems. Enhance access controls, bolster your digital infrastructure defenses, and maintain heightened vigilance. Stay informed about potential threats and continuously monitor trusted sources for updates to ensure robust cybersecurity. Link to the Research Report: FortiOS/FortiProxy (CVE-2024-21762)- Vulnerability Analysis and Exploitation - CYFIRMA#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #Cy...2024-03-2202 minCYFIRMA ResearchCYFIRMA Research - Jenkins (CVE-2024-23897) – Vulnerability Analysis and ExploitationUrgent Security Advisory! A critical vulnerability, CVE-2024-23897, has surfaced in Jenkins, posing a global threat to digital security. CYFIRMA researchers have conducted an in-depth analysis and exploitation, Immediate action is advised - secure your systems with the latest Jenkins patches. Strengthen access controls, fortify your digital infrastructure, and remain vigilant. Stay informed about potential threats and regularly monitor trusted sources for updates to ensure robust cybersecurity.Link to the Research Report: Jenkins (CVE-2024-23897) - Vulnerability Analysis and Exploitation - CYFIRMA#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #JenkinsSecurity #SecurityUpdates #CVE-2024-23897 #Jenkins #ETLM...2024-02-1903 minWe Speak CVEThe Council of RootsLearn how CVE Numbering Authority (CNA) partners—ranging from large to small organizations, proprietary and open-source products or projects, disparate business sectors, and different geographic locations—are overseen and supported within the CVE Program by “Top-Level Roots” and “Roots.” Topics include the roles and responsibilities of the two different types of Roots; how their work benefits the CNAs under their care; how they recruit new CNA partners, including suggestions for addressing upper management concerns if a CNA prospect organization is hesitant to partner as a CNA; how they work with and support their CNAs over time; how the “Council of Roots” work...2024-01-3048 minCYFIRMA ResearchCYFIRMA Research - OwnCloud: CVE-2023-49103 Vulnerability Analysis and ExploitationCYFIRMA’s Research team has conducted a thorough analysis of the critical security vulnerability, CVE-2023-49103, in OwnCloud's Graph. Uncovered by ownCloud on November 21, 2023, this vulnerability is assigned a CVSS score of 7.5, underscoring its severity. This flaw directly impacts OwnCloud/graphapi, posing a significant risk of unauthorized access to sensitive information! Our report provides valuable insights into the nature of the vulnerability, its potential impact, insights from underground forums and the critical importance of prompt mitigation. Link to the Research Report: OwnCloud : CVE-2023-49103 Vulnerability Analysis and Exploitation - CYFIRMA#CyberSecurity #OwnCloud #VulnerabilityAlert #St...2023-12-2603 minCYFIRMA ResearchCYFIRMA Research - F5 BIG-IP Remote Code Execution – CVE-2023-46747 – Vulnerability Analysis and ExploitationA critical vulnerability, CVE-2023-46747, has surfaced in the F5 BIG-IP Traffic Management User Interface (TMUI), posing a significant global threat to organizations. This flaw enables unauthorized remote code execution, potentially compromising digital assets. CYFIRMA’s Research team has conducted an extensive analysis of this security flaw.Take Immediate Action! Ensure your systems are shielded with the latest F5 patches. Strengthen access controls and maintain vigilant monitoring of your digital infrastructure. Link to the Research Report: F5 BIG-IP Remote Code Execution - CVE-2023-46747 - Vulnerability Analysis and Exploitation - CYFIRMA2023-12-1103 minWe Speak CVEHow the New CVE Record Format Will Benefit ConsumersShannon Sabens of CrowdStrike and Kent Landfield of Trellix, both of whom are CVE Board members and CVE Working Group chairs, speak about how the new CVE Record format — with its new structured data format and optional information fields — will benefit and provide enhanced value to consumers of CVE content moving forward. Specific topics discussed include how the new CVE Record format will enable more complete vulnerability information to be captured early on in the advisory process and how that will benefit consumers; the ability for CVE content consumers to streamline and more easily automate their use of CV...2023-09-2725 min
Inside Rehabilitation CounselingExploring the CVE Certification with Lisa Byrne, MA, CRC, CVE, LCPCThe Certified Vocational Evaluator certification, or CVE, is a high-demand specialty within rehabilitation counseling. CVEs possess unique, comprehensive, and holistic proficiencies in evaluation, career assessment services, and job placement cases. The CRC-CVE dual certification can also provide clients and employers with higher success rates and overall better client outcomes.Lisa Byrne was instrumental in the revitalization of the CVE certification under CRCC, and on this episode, she shares with us the scope of the specialization and why it’s important for clients and employers.Learn more about the CVE Certification and apply for the February 2024 co...2023-09-2019 min
Open Source SecurityCurl and the calamity of CVEJosh and Kurt talk about why CVE is making the news lately. Things are not well in the CVE program, and it's not looking like anything will get fixed anytime soon. Josh and Kurt have a unique set of knowledge around CVE. There's a lot of confusion and difficulty in understanding how CVE works. Show Notes Curl blog post Now it's PostgreSQL's turn to have a bogus CVE GitHub Advisory Database Josh's "CVE tried to get me fired" story 2023-09-1146 minInside Rehabilitation CounselingPREVIEW: A Conversation with Lisa Byrne, MA, CRC, CVE, LCPCOn the next episode of Inside Rehabilitation Counseling, we explore the Certified Vocational Evaluation Specialist (CVE) credential and how it compliments the CRC in serving individuals with disabilities. Our guest is Lisa Byrne, MA, CRC, CVE, LCPC, an integral reason that the CVE was revitalized as a credential for rehabilitation counseling professionals. 2023-09-0600 min
It's 5:05! Daily cybersecurity and open source briefingEpisode #200 - Potential WeChat Ban on Australian Government Devices, NATO Tech Funding, Apple Kernel Flaw CVE 2023-38606, New Apple Vulnerability: Device Owner Call To Action, Apple CVE, Operation Triangulation Take Two - Apple Gadgets Exploited in Data Stealing Operation?, This Day, August 4, 5 in Tech History🎙️ Free access to “It’s 5:05!” on your favorite podcast platforms: bit.ly/its505-free-access-on-all-podcast-platforms 📌Today is August 4th and it's our 200th episode at "It's 5:05". So we have something special planned. This is Executive Producer, Mark Miller. In addition to our regular format, we are extending the show today to include "The Story of the Week", where four of our journalists examine the same topic from different viewpoints. With Apple's announcement of a critical exploit in it's kernel prior to 15.7.1, Tracy Bannon, Katy Craig, Olimpiu Pop, and Marcel Brown will give you their individual takes on this known v...2023-08-0414 min
Cup o' GoIs it Gone-W or Go-New? Plus CVE fixes, Go Dev Survey, and Benthos interviewGo 1.21RC4 is out🪳 CVEsCVE-2023-29409 fixed in Go 1.20.7 & 1.19.12CVE-2023-3978 fixed in golang.org/x/net & golang.org/x/net/html v0.13.0CVE-2023-29407 & CVE-2023-29408 fixed in golang.org/x/image & golang/x/image/tiff v0.10.0🗳️ Go Developer Survey open until August 10🆕 gonew: Experimenting with project templates by Cameron Balahan📘 Have you written a book about Go? Contact Bill Kennedy: bill@ardenlabs.comProposal: time: stop requiring Timer/Ticker.Stop for prompt GCBlog post: Zero allocations metrics with opentelemetry-go by Howard JohnInterviewBenthos projectBenthos community linksAshley JeffsTwitterLinkedInGitHubMihai TodorTwitterLinkedInGitHub
★ Support this podcast on Patreon ★
2023-08-0457 minWe Speak CVEBecoming A CNA—Myths versus FactsHost Shannon Sabens of CrowdStrike chats with Julia Turkevich of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) about the myths and facts of partnering with the CVE Program as a CVE Numbering Authority (CNA).Truth and facts about the following myths are discussed:Myth #1: Only a specific category of software vendors can become CNAs.Myth #2: Organizations cannot leverage their existing vulnerability management and disclosure processes when they become a CNA.Myth #3: The requirements for becoming a CNA are overwhelming and extensive.Myth #4: A fe...2023-06-2122 min
FOCUS ON: LinuxNewsupdate 05/23 - Linux 6.3 und 6.4-rc1, CVE-2023-0386/32233, QEMU 8.0, RHEL 9.2, LIT 2023#CurlMeMayBe
Die Kernel-Maintainer:innen schicken Linux 6.3 und 6.4-rc1 ins Rennen, während zwei CVEs geschlossen werden wollen. QEMU veröffentlicht mit 8.0 eine neue Hauptversion mit überschaubaren Änderungen. RHEL und AlmaLinux 9.2 werden veröffentlicht, parallel lässt Rocky Linux noch auf sich warten. An der Hochschule Augsburg findet der Augsburger Linux-Infotag statt, während Red Hat Summit und SUSECON in greifbare Nähe rücken. openSUSE ALP und SoftMaker Office suchen nach Feedback.
Feedback
Interview mit Lomiri-Lead Developer: https://www.youtube.com/watch?v=Lc6gGs2kM4c
Aufreger des Monats
Red Hat KB "systemd-cryptsetup: Encounter...2023-05-191h 15We Speak CVEMicrosoft’s Journey Adopting CVE Services & CVE JSON 5.0Kris Britton of the CVE Program speaks with Lisa Olson of Microsoft about Microsoft’s journey adopting the new CVE Services and CVE JSON 5.0 into their vulnerability management infrastructure and how they used them for the first time as part of Microsoft’s February 2023 Patch Tuesday.Discussion topics include the CVE JSON 5.0 schema mind map and other schema resources on GitHub; reviewing CVE JSON 5.0 records on the CVE.ORG website; using Vulnogram, or one of the other CVE Services clients...2023-03-0730 min
Codice Insicuro - (a cura di Paolo Perego)Analizziamo insieme la CVE-2021-33226Oggi vediamo un po' come gestisco l'analisi di una vulnerabilità.
Tutto nasce da una CVE su salt che si è materializzata all'improvviso nel sistema di ticketing di SUSE.
Un'esecuzione di codice arbitrario con CVSS 9.8, gli ingredienti per una pessima giornata da gestire. Come sarà andata?
La pagina del NIST per questa CVE: https://nvd.nist.gov/vuln/detail/CVE-2021-33226
La mia analisi: https://bugzilla.suse.com/show_bug.cgi?id=1208473
Il progetto salt: https://saltproject.io/2023-03-0315 min
CYBER2GOAnonymous Sudan rammer hospitaler, WordPress plugin og tema: 9.8-score CVE, Microsoft Defender auto-tilføjes i 365Tre emner dækker dagens episode: Anonymous Sudan har taget ansvar på DDoS-angreb der har ramt hospitaler og lufthavne landet over. WordPress plugin og -tema Houzez har to CVE'er med CVSS-scorer på 9.8. Microsoft auto-tilføjer og slår Microsoft Defender til på Windows 10-maskiner der bruger Microsoft 365.CVE'er nævnt i denne episode: CVE-2023-26540 og CVE-2023-26009.Vært: Omar Hawwash, Cybersikkerhedskonsulent og journalist, LEVEL7. 2023-02-2803 minCYBER2GOApple patcher zero-day til iPhones og iPads, CFCS opdaterer logging-guide, GTA V Online får CVETre emner dækker dagens episode: Apple har udgivet en vigtig patch for en zero-day sårbarhed, som de har fået rapporter på er blevet 'aktivt misbrugt'. Centeret for Cybersikkerhed har opdateret deres logging-guide, i kølvandet på de nylige DDoS-angreb. GTA V Online har fået sin første CVE for 2023.CVE'er nævnt i denne episode: CVE-2022-42856 (Apple) og CVE-2023-24059 (GTA)Vært: Omar Hawwash, Cybersikkerhedskonsulent og journalist, LEVEL7. 2023-01-2404 minWe Speak CVECoordinated Vulnerability DisclosureShannon Sabens of CrowdStrike chats with Madison Oliver of GitHub Security Lab about the recent release of OpenSSF’s “Guidance for Security Researchers to Coordinate Vulnerability Disclosures with Open Source Software Projects” document and the important step of obtaining a CVE ID in the coordinated vulnerability disclosure process for open-source vulnerabilities.OpenSSF is a “cross-industry organization that brings together the industry’s most important open source security initiatives and the individuals and companies that support them.” The CVD Guide was released by OpenSSF’s Vulnerability Disclosure working group in September 2022, which in 2021 released its “Guide to Implementing a Coordinated Vu...2022-12-3023 min
FOCUS ON: LinuxNewsupdate 11/22 – CVE-2022-3602/3786, Python 3.11, Fedora 37, Gitea-Fork, RHEL 8.7/9.1Mit Python 3.11 und Fedora 37 besprechen wir zwei langersehnte Versionsupdates. Letzteres wurde aufgrund des berüchtigten CVE-2022-3602 und 3786 mehrfach verschoben. Ein neues Unternehmen rund um Gitea beschert uns einen Fork, während eine Diskussion übe
Mit Python 3.11 und Fedora 37 besprechen wir zwei langersehnte Versionsupdates. Letzteres wurde aufgrund des berüchtigten CVE-2022-3602 und 3786 mehrfach verschoben. Ein neues Unternehmen rund um Gitea beschert uns einen Fork, während eine Diskussion über Blockchain-Technologie und LibreOffice die Gemüter erhitzt. Microsoft stellt seine neue Teams-PWA und Lennart Poettering mit Unified Kernel Images einen Ansatz vor, um den Bootvorgang weiter abzusichern.
Feedback / Ankündi...2022-11-251h 05We Speak CVECNA Mentoring Program: Members Helping MembersHost Shannon Sabens of CrowdStrike chats with Tod Beardsley of Rapid7, who is the chair of the CVE Program's CNA Coordination Working Group (CNACWG), about the CNACWG’s "CNA Mentoring Program." Topics discussed include how CVE is a community, how the mentoring program is as little or as much work as you’d like it to be, the many ways in which mentoring can help new CVE Numbering Authorities (CNAs) be successful, the benefits to both organizations, the very simple signup process (a Google form, no login requ...2022-10-1821 minWe Speak CVEAn Insider’s View of the CVE ProgramShannon Sabens of CrowdStrike and Tod Beardsley of Rapid7, both of whom are CVE Board members and CVE Working Group chairs, chat about the CVE Program from their insider’s perspectives.Topics include the value of a federated program of CVE Numbering Authorities (CNAs) from around the world for increased assignment of CVE Records; the upside and minimal requirements to becoming a CNA; the types of organizations that are CNAs; how CNAs are a community with a mentoring program; how CNAs assigning CVE Identifiers (CV...2022-09-2723 min
Time For A Reset Marketing Podcast: Insights from Global Brand MarketersEpisode 39 - The Inside Track on Why Canton Joined CvEAre you curious about the behind-the-scenes story of how Canton Marketing Solutions joined the CvE and Goodway Group family? In this week's episode of Time for a Reset, we sit down with founders Rob Webster and Nick King, who share their journey and the reasons behind their decision.With decades of experience in digital marketing and leadership roles at top companies such as MediaCom, Yahoo, Tacoda, Crimtan, News UK and Future, Rob and Nick are experts in the field. In 2018, they founded Canton Marketing Solutions, a consultancy aimed at helping brands take control of their digital marketing...2022-09-0842 min
FOCUS ON: LinuxNewsupdate 06/22 – CVE-2022-1966, openSUSE Leap 15 SP4, AlmaLinux 9.0, NixOS 22.05, HP Dev OneKurz vor dem Sommerloch erreicht uns mit CVE-2022-1966 wieder eine kritische Sicherheitslücke, die es zu schließen gilt. Glücklicherweise gibt es mit openSUSE Leap 15 SP4, AlmaLinux 9.0 und NixOS 22.05 neue Distributionsversionen mit erfreulichen Verände
Kurz vor dem Sommerloch erreicht uns mit CVE-2022-1966 wieder eine kritische Sicherheitslücke, die es zu schließen gilt. Glücklicherweise gibt es mit openSUSE Leap 15 SP4, AlmaLinux 9.0 und NixOS 22.05 neue Distributionsversionen mit erfreulichen Veränderungen. Canonical zeigt sich bemüht, Ubuntu "snappier" zu machen und Christian findet HPs neues Dev One-Notebook vielversprechend und gleichermaßen überarbeitungswürdig.
Links zur Folge: 2022-06-241h 04We Speak CVEThe Value of Assigning CVEsShannon Sabens of CrowdStrike chats with Madison Oliver of GitHub Security Lab about how and why CVEs are assigned, the value of CVEs in vulnerability management, responsible coordination of vulnerability disclosures, the importance of comprehensiveness in security advisories, and why there is no stigma in a CVE. CVE Numbering Authority (CNA) scopes, disclosure policies, turnaround times, and more are discussed in general, as are GitHub’s specific CNA processes and how it helps open-source projects hosted on GitHub with their CVEs and advisories. Madison also writes about many of these topics in...2022-06-1419 minWe Speak CVEResearchers and PSIRTs Working Well TogetherShannon Sabens of CrowdStrike and Milind Kulkarni of a NVIDIA discuss what security researchers should expect when reporting vulnerabilities to a Product Security Incident Response Team (PSIRT); how to best to collaborate with them; how to interpret responses from the PSIRT; how to get the best outcome when making a report; supported versus end-of-life (EOL) products; CVE Numbering Authority (CNA) scopes; timing of a patch versus the publication of a CVE Record; and more. 2022-05-0326 min
FOCUS ON: LinuxNewsupdate 04/22 – CVE-2022-1015/1016, Ubuntu 22.04 LTS, elementaryOS, SUSE Adaptive Linux Platform, Red Hat Satellite 7.0Auch im April reißt die Kette nicht ab: mit CVE-2022-1015 und CVE-2022-1016 gibt es wieder zwei Sicherheitslücken, die es zu schließen gibt. Wir besprechen das sehnlich erwartete Ubuntu 22.04 LTS-Release und die aktuelle Pop!_OS-Beta. Weniger schöne News
Auch im April reißt die Kette nicht ab: mit CVE-2022-1015 und CVE-2022-1016 gibt es wieder zwei Sicherheitslücken, die es zu schließen gibt. Wir besprechen das sehnlich erwartete Ubuntu 22.04 LTS-Release und die aktuelle Pop!_OS-Beta. Weniger schöne News gibt es aus dem elementaryOS-Projekt, welches sich nach Streitigkeiten neu ausrichtet. SUSE lässt mit A...2022-04-291h 08
Man Behind The MachinePegasus, 1984, CVE-2016-4655, CVE-2016-4656, CVE-2016-4657 War gamesOn this episode: Pegasus fly fly fly : Pegasus is able to exploit iOS versions up to 14.6, through a zero-click exploit Pegasus was a beautiful winged horse who sprang from the body of Medusa when she was slain by the hero Perseus, the son of Zeus and Danaë. Spreading out his wings he immediately flew to the top of Mount Olympus, where he was received with delight and admiration by all the immortals. Pegasus : iOS, Cyberspace, 1984, CVE-2016-4655, CVE-2016-4656, CVE-2016-46572022-04-201h 41
생존형 개발자 성냥의 불친절한 코딩 이야기31회. 윈도우 Git 보안 취약점 CVE-2022-24765, CVE-2022-24767. Git v2.35.2 업데이트 하세요.Hello World! 감사합니다!
ㆍ문의/의견: seongnyang.unkind.coding@gmail.com
ㆍ트위터: https://bit.ly/3pFyBV5
ㆍ음악
Track - MBB - Feel Good
Soundcloud - https://soundcloud.com/mbbofficial
나눔뮤직 - https://tv.naver.com/v/9399139
ㆍ참고
- https://www.cvedetails.com/cve/CVE-2022-24767/
- https://github.blog/2022-04-12-git-security-vulnerability-announced/
- https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh22022-04-1605 minWe Speak CVEThe Latest on Transitioning to CVE Services 2.1 & CVE JSON 5.0Lisa Olson of Microsoft and Kris Britton of the CVE Program speak with Kelly Todd of the CVE Program about the transition that’s currently underway for CVE Numbering Authorities (CNAs) to CVE Services 2.1 and CVE JSON 5.0. Their discussion includes how the new services and data format will enable effective and secure automation, improve workflows, and reduce the transaction costs of program participation for CNAs, as well as provide enhanced information in CVE Records for use by downstream consumers.Specific topics include how the CVE Services 2.1 web application adds the CVE Record Submission and Upload Service (RSUS) fo...2022-03-1522 min
401 Access DeniedMitigating Polkit CVE-2021-4034 with CyDefe | The Cybrary Podcast Ep. 78Ready to defend your organization against the widespread PolicyKit vulnerability that experts are comparing to the Log4j flaw? In this episode of the Cybrary Podcast, Raymond Evans, CEO of CyDefe Labs, discusses his latest Cybrary course on Polkit CVE-2021-4034. By exploiting this flaw, just how easy is it to gain root access on a target system? What can we learn from this vulnerability about the value of penetration testers and open-source software? Find out in this podcast and in Ray's course!
Enroll now in Ray's newest course!
~CVE Series: Polkit (CVE-2021-4034)
2022-02-1638 min
Enterprise Linux SecurityEnterprise Linux Security Episode 17 – Polkit & LUKS CVE’sThe New Year is just beginning, and we already have a few important CVE's to discuss, this time around Polkit and LUKS. The CVE numbers for these vulnerabilities are CVE-2021-4034 and CVE-2021-4122 respectively. In this episode, Jay and Joao discuss these vulnerabilities.2022-01-3034 min
FOCUS ON: LinuxNewsupdate 01/22 – CVE-2022-0185, D-Installer, SUSE Liberty LinuxDas neue Jahr beginnt wie das alte Jahr endete: mit einer knackigen CVE! Neben fehlerhaften Operatoren thematisieren wir auch den womöglich größten Kernel-Einzelpatch aller Zeiten. Es keimen Gerüchte um einen weiteren CentOS-Fork auf, während SUSE und Fe
Das neue Jahr beginnt wie das alte Jahr endete: mit einer knackigen CVE! Neben fehlerhaften Operatoren thematisieren wir auch den womöglich größten Kernel-Einzelpatch aller Zeiten. Es keimen Gerüchte um einen weiteren CentOS-Fork auf, während SUSE und Fedora an neuen Web-Installern arbeiten. Ubuntu schraubt an Snapcraft und schneidet alte Zöpfe ab.
AppImage, Flatpak und Snap im...2022-01-2854 minWe Speak CVEEnhancing CVE Records as an Authorized Data PublisherKent Landfield of McAfee and Art Manion of CERT/CC discuss how the CVE Program’s upcoming release of JSON 5.0 will allow for additional and related information to be added to CVE Records after they have been published by CVE Numbering Authorities (CNAs). These additions — such as risk scores, affected product lists, versions, references, translations, etc. — will be made by “Authorized Data Publishers (ADPs),” which will be organizations authorized within the CVE Program to enrich the records. Also discussed are the benefits of enriched CVE Records to downstream users and the overall vulnerability management community, the use of Stakeholder-specific Vulnerabil...2021-12-0727 minWe Speak CVEHow Red Hat's Active Participation Helps Improve the CVE ProgramShannon Sabens of CrowdStrike chats with Peter Allor, Fábio Olivé, and Martin Prpic of Red Hat, which is a long-time CVE Numbering Authority (CNA). The benefits of actively participating as a member of the CVE community are discussed, especially in the CVE Working Groups, which allows Red Hat to directly contribute to enhancing CVE automation and quality, as well as strategic planning for future improvements.Specific topics include Red Hat being a resource for other CNAs, particularly for open-source vendors and projects; the industry-wide value of the upcoming CVE Record JSON Schema to be a universal vu...2021-11-2024 minWe Speak CVECVE Myths versus FactsEpisode 9 – Three CVE Board members provide the truth and facts about the following myths about the CVE Program: Myth #1: The CVE Program is run entirely by the MITRE Corporation Myth #2: The CVE Program is controlled by software vendors Myth #3: The CVE Program doesn’t cover enough types of vulnerabilities Myth #4: The CVE Program is responsible for assigning vulnerability severity scores CVE Program – https://www.cve.org CVE Board – https://www.cve.org/ProgramOrganization/Board 2021-10-1227 minWe Speak CVECVE Working Groups, What They Are and How They Improve CVEOur eighth episode is all about how community members actively engage in the six CVE Working Groups (WGs) to help improve quality, automation, processes, and other aspects of the CVE Program as it continues to grow and expand. The chairs and co-chairs of each WG, each of whom is an active member of the CVE community, chat about their WG’s overall mission, current work, and future plans. Discussion begins with the Transition (TWG), a temporary WG focused on managing the numerous modernization, automation, and process transitions currently underway in the CVE Program. Each of the five ma...2021-09-0226 minWe Speak CVEManaging Modernization and Automation Changes in the CVE ProgramEpisode 7 – Kelly Todd of the CVE Program speaks with Lisa Olson of Microsoft about managing the modernization and automation changes currently underway in the CVE Program. Topics include the efforts of the newly formed CVE Transition Working Group (Lisa, a CVE Board member, is co-chair); automation of CVE ID assignment and CVE Record publishing for CVE Numbering Authorities (CNAs), including the availability of free APIs and other improvements on the way; the upcoming new version release of JSON for the CVE Record format to enhance the data associated with a record; the upcoming availability of program metrics for the CV...2021-08-2122 min