IS Security CERT Global

• Challenges to Assuring Large-Scale Systems
  National defense efforts have shifted from defeating terrorism to accelerating innovation, with a priority of delivering capability at speed and at scale. ... read more
• Multiples vulnérabilités dans les produits Moxa (14 octobre 2024)
  De multiples vulnérabilités ont été découvertes dans les produits Moxa. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique ... read more
• Multiples vulnérabilités dans Moodle (14 octobre 2024)
  De multiples vulnérabilités ont été découvertes dans Moodle. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un ... read more
• Bulletin d'actualité CERTFR-2024-ACT-045 (14 octobre 2024)
  Ce bulletin d’actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l’analyse de l’ensemble des avis et alertes publiés ... read more
• Measuring AI Accuracy with the AI Robustness (AIR) Tool
  Understanding your artificial intelligence (AI) system’s predictions can be challenging. In this post, SEI researchers discuss a new tool to help improve AI classifier performance. ... read more
• U.S. Army Cyber Command celebrates 14 years of service
  On Oct. 1, 2024, U.S. Army Cyber Command (ARCYBER) will celebrate 14 years of service, saluting the date in 2010 when the command reached its full opera ... read more
• CISA’s VDP Platform 2023 Annual Report Showcases Success
  Today, the Cybersecurity and Infrastructure Security Agency (CISA) released its Vulnerability Disclosure Policy (VDP) Platform 2023 Annual Report, highlighting the service’s remarkable success in 2023, its second full year of operation. ... read more
• CISA Adds Four Known Exploited Vulnerabilities to Catalog
  CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-25280 D-Link DIR-820 Router OS Command Injection Vulnerability CVE-2020-15415 DrayTek Multiple Vigor Routers OS Command ... read more
• Bulletin d'actualité CERTFR-2024-ACT-043 (30 septembre 2024)
  Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés ... read more
• Multiples vulnérabilités dans Foxit PDF Editor (30 septembre 2024)
  De multiples vulnérabilités ont été découvertes dans Foxit PDF Editor. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une ... read more
• WordPress Plugin “Forminator” vulnerable to cross-site scripting
  WordPress Plugin "Forminator" provided by WPMU DEV contains a cross-site scripting vulnerability. ... read more
• “@cosme” App fails to restrict custom URL schemes properly
  "@cosme" App provided by istyle Inc. fails to restrict custom URL schemes properly. ... read more
• Multiples vulnérabilités dans les produits IBM (06 septembre 2024)
  De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service ... read more
• Multiples vulnérabilités dans le noyau Linux de Red Hat (06 septembre 2024)
  De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Elles permettent à un attaquant de provoquer un déni de service. ... read more
• Multiples vulnérabilités dans le noyau Linux d'Ubuntu (06 septembre 2024)
  De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la ... read more
• Vulnérabilité dans le noyau Linux de SUSE (06 septembre 2024)
  Une vulnérabilité a été découverte dans le noyau Linux de SUSE. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. ... read more
• Multiples vulnérabilités dans Elastic Kibana (06 septembre 2024)
  De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance. ... read more
• Vulnérabilité dans les produits Asterisk (06 septembre 2024)
  Une vulnérabilité a été découverte dans les produits Asterisk. Elle permet à un attaquant de provoquer un déni de service à distance. ... read more
• JVN: Panasonic製Control FPWIN Pro7におけるスタックベースのバッファオーバーフローの脆弱性
  Panasonicが提供するControl FPWIN Pro7には、スタックベースのバッファオーバーフローの脆弱性が存在します。続きを読む ... read more
• JVN: IDEC製PLCにおける複数の脆弱性
  IDEC株式会社が提供するPLC（Programmable Logic Controller）には、複数の脆弱性が存在します。続きを読む ... read more
• JVN: IPCOMにおける処理時間の相違に起因する情報漏えいの脆弱性
  エフサステクノロジーズ株式会社が提供するIPCOMのSSLアクセラレータ機能およびSSL-VPN機能には、処理時間の相違に起因する情報漏えいの脆弱性が存在します。続きを読む ... read more
• JVN: WordPress用プラグインCarousel Sliderにおける複数の脆弱性
  Sayful Islamが提供するWordPress用プラグインCarousel Sliderには、複数の脆弱性が存在します。続きを読む ... read more
• JVN: Rockwell Automation製ThinManager ThinServerにおける複数の脆弱性
  Rockwell Automationが提供するThinManager ThinServerには、複数の脆弱性が存在します。続きを読む ... read more
• IPCOM vulnerable to information disclosure
  SSL Accelerator/SSL-VPN Function of IPCOM provided by Fsas Technologies Inc. contains an information disclosure vulnerability. ... read more
• Multiple vulnerabilities in IDEC PLCs
  IDEC PLCs (Programmable Logic Controllers) contain multiple vulnerabilities. ... read more
• Panasonic Control FPWIN Pro7 vulnerable to stack-based buffer overflow
  Control FPWIN Pro7 provided by Panasonic contains a stack-based buffer overflow vulnerability. ... read more
• TZCERT-SU-24-0954 (Tenable Security Update)
  Tenable has released security updates to address vulnerabilities in Fortra FileCatalyst and Flowise. Exploitation of these vulnerabilities may allow an attacker to bypass security controls. Users and administrators are encouraged ... read more
• TZCERT-SU-24-0960 (F5 Security Update)
  F5 has released security updates to address vulnerabilities in Linux kernel. Exploitation of these vulnerabilities may allow an attacker to gain escalated privilege. Users and administrators are encouraged to review ... read more
• TZCERT-SU-24-0959 (SUSE Security Update)
  SUSE has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users and administrators are encouraged ... read more
• TZCERT-SU-24-0957 (DebianOS Security Update)
  Debian has released security updates to address vulnerabilities in trafficserver and python. Exploitation of these vulnerabilities may allow an attacker to cause a denial of service condition. Users and administrators ... read more
• TZCERT-SU-24-0958 (Chrome Security Update)
  Google has released security update to address vulnerabilities in powermail. Exploitation of these vulnerabilities may allow an attacker to gain escalated privilege. Users and administrators are encouraged to review Typo3 ... read more
• TZCERT-SU-24-0955 (Dell Security Update)
  Dell has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users and administrators are encouraged ... read more
• TZCERT-SU-24-0956 (IBM Security Update)
  IBM has released security updates to address vulnerabilities in its multiple products. Exploitation of these vulnerabilities may allow an attacker to cause a denial of service condition. Users and administrators ... read more
• WindLDR and WindO/I-NV4 store sensitive information in cleartext
  WindLDR and WindO/I-NV4 provided by IDEC Corporation store sensitive information in cleartext form. ... read more
• Multiple vulnerabilities in IDEC Operator Interfaces products
  IDEC Operator Interfaces products contain multiple vulnerabilities which are due to Zuken Elmic TCP/IP protocol stack. ... read more
• Kritisk sårbarhed i SonicOS
  Der er fundet en kritisk sårbarhed i adgangskontrollen i nogle versioner af SonicWalls SonicOS. Det fremgår af en advisory fra SonicWall. Sårbarheden kan udnyttes af en ondsindet aktør til at ... read more
• Falske mails fra CFCS i omløb
  Der er tale om en phishing-mail, som ondsindede aktører sender ud for at lokke modtageren til, at afgive information eller downloade malware. Læs mere om phishing og hvordan du spotter ... read more
• Falske mails fra CFCS i omløb
  CFCS (Center for Cybersikkerhed) meddeler, at enkelte borgere har henvendt sig fordi de har modtaget mails, som udgiver sig for at være fra CFCS. De falske mails bærer overskriften "Sikkerhedsadvarsel" ... read more
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-38856  Apache OFBiz Incorrect Authorization Vulnerability These types of vulnerabilities are frequent attack vectors ... read more
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-7971 Google Chromium V8 Type Confusion Vulnerability These types of vulnerabilities are frequent attack ... read more
• TZCERT-SU-24-0940 (Oracle Linux Security Update)
  Oracle has released security update to address a vulnerability in tomcat. Exploitation of this vulnerability may allow an attacker to cause a denial of service condition. Users and administrators are ... read more
• TZCERT-SU-24-0942 (SUSE Security Update)
  SUSE has released security updates to address vulnerabilities in Apache, xen and oniguruma. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users and administrators ... read more
• TZCERT-SU-24-0949 (Joomla Security Update)
  Joomla has released security updates to address vulnerabilities in Joomla CMS. Exploitation of these vulnerabilities may allow an attacker to gain escalated privilege. Users and administrators are encouraged to review ... read more
• TZCERT-SU-24-0948 (Red Hat Security Update)
  Red Hat has released security updates to address vulnerabilities in tomcat, 389-ds, python and kernel. Exploitation of these vulnerabilities may allow an attacker to cause a denial of service condition. ... read more
• TZCERT-SU-24-0947 (Ruby Security Update)
  Ruby has released security update to address a vulnerability in REXML gem. Exploitation of this vulnerability may allow an attacker to cause a denial of service vulnerability. Users and administrators ... read more
• TZCERT-SU-24-0946 (DebianOS Security Update)
  Debian has released security updates to address vulnerabilities in nova, glance, cinder, aom and dovecot. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users ... read more
• TZCERT-SU-24-0945 (IBM Security Update)
  IBM has released security updates to address vulnerabilities in its multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users and administrators are ... read more
• TZCERT-SU-24-0943 (Cisco Security Update)
  Cisco has released security updates to address vulnerabilities in its multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of affected system. Users and administrators are ... read more
• TZCERT-SU-24-0944 (Ubuntu Security Update)
  Ubuntu has released security updates to address vulnerabilities in QEMU, Linux kernel, vim and Firefox. Exploitation of these vulnerabilities may allow an attacker to cause a denial of service condition. ... read more
• TZCERT-SU-24-0941 (Autodesk Security Update)
  Autodesk has released security update to address a vulnerability in Revit. Exploitation of this vulnerability may allow an attacker to take control of affected system. Users and administrators are encouraged ... read more