#cves

[digitalcreationsllc]

Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products | Zyxel Networks

CVEs: CVE-2023-35137, CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, CVE-2023-4474 Summary Zyxel has released patches addressing an authentication bypass vulnerability and command injection vulnerabilities in NAS products. Users are advised to install them for optimal protection. What are the vulnerabilities? CVE-2023-35137 An improper authentication vulnerability in the…

[carbone14]

Un F4U-4 Corsair du Marine Fighter Attack Squadron VMFA-212 est sur la catapulte, prêt pour un lancement depuis le porte-avions d'escorte USS Badoeng Strait (CVE-116) pour une frappe en Corée – Guerre de Corée – 1952

Photographe : Gerald Haddock

©US Navy National Museum of Naval Aviation - 1996.253.7154.010

[burned-lariat]

Allegedly, Alley Mills revealed during her appearance at Fan Club Weekend that she was not happy that Patrick Mulcahey wanted to write Heather as a grey villain. She wants Heather to be more comical, almost like her character Pam on the Bold and the Beautiful. So, she complained to Frank and her good buddy CVE. CVE then went behind Patrick's back and told Alley she can change her dialogue to however she sees fit. And now that he's back at the helm, Heather Webber is gonna be the crazy, silly old auntie of the town. She also revealed Heather has a HUGE story in the fall.

Frank/ABC want this show cancelled. You can't convince me otherwise.

[cve-th3mvsic]

i want to get invested in someone’s ocs

i need to go to bed tho. fml.

WAIT YIPPIE ‘CAUSE TMR IS A TESTING DAY AND I GET OUT AT 12:30 LETS GOOO (i’ll have more time to do stuff after school, sweet)

[rubeslovesthesmiths]

rubes, you remind me of the color dark red-ish grey-ish, like a maroon-ish kinda color? like the color of rubies

you remind me of the color green too, like dark-ish green. you remind of colors with a grey-ish tone (i love colors with a grey-ish tone so much)

you remind me of deep red, lots of deep red vibes. and garnet i think. you remind me of garnet

and like, the vibe of a stage, you give off the vibe of a big stage

oh, and adventure time for some reason, you give off the vibe of adventure time

you remind me of colors, when i think of you i think of colors

js to let ya know ^^

___

I am gonna cry this is so sweet. It's so sweet you even think of me and I remind you of things. I'm gonna cry omg. I am in love with you platoncially now.

[curryvillain]

Likkle Addi & Vybz Kartel Run The League In "M.O.T.M (Man Of The Match)"

The Dancehall world has been enjoying the day to day life of Vybz Kartel, and the inclusion of his many co-stars. Plenty of these co-stars have been heavily campaigning for his release over the years and kept his name alive, and those include his sons Likkle Addi, Likkle Vybz, and Aiko. The sons have been busy with their own music as well, and they’ve managed to build their respective fanbases.…

[wirelessmemoryadministratorbrad]

[finalfroevo]

defeated Radiance & got the Dream no More ending

:] !!

[raj173]

poc for cve-2024-36401 remote Code Execution

#CyberAttack #cve202436401 #bugbountytips #BugBounty #RCE #cve #Linux #Claude #Caturday #Vox3D #BritishGP

[szepkerekkocka]

"CVSS is a shitty system"

Esettanulmányok arról, hogy készül a virsli CVSS (Common Vulnerability Scoring System), a cURL vezető fejlesztőjének előadásában.

@muszeresz

[burned-lariat]

I need someone to:

Take Chris Van Etten's laptop

Delete all his scripts and ideas for this Heather "redemption" (AKA the third redemption plot he's trying to make work)

Delete any backups or cloud data on said scripts and ideas

Bash the device in with a hammer

Hand the man his pink slip

Thank you!

[cve-th3mvsic]

it’s that time of the day, sleepy loopy time 🔥‼️

before my brain and thoughts fully leave, i js wanna say

why are the girls at my school so so so SO much prettier than the guys? like. the guys look so basic. i’m sorry dude, but almost all of them are sooo basic. too many edgars…. so many guys wearin’ the same kinda outfits.. same hairdos…... like probably only a few guys are pretty. there are definitely more pretty girls than pretty boys here.

girls are beautiful. they’re so pretty. so majestic. oh my gosh.

GUYS I THOUGHT I WAS GAY…

i’m still aroace dw. (ttms)

___

[rubeslovesthesmiths]

would you rather be too hot or too cold? and why?

___

Too cold! Being cold is how I feel usually, plus you can always get warmer, or aleast, it's easier

[zzkt]

Update maintainer and author info · tukaani-project/xz@77a294d

[reliqus]

WordPress users, beware! A new phishing scam targeting the popular content management system was discovered on January 5th, 2024. This scam involves a fake 'CVE-2024-46188' patch that claims to fix a security vulnerability in WordPress. However, this is actually a cleverly crafted phishing attempt to steal sensitive information from unsuspecting website owners. 

Remember, as per the WordPress team, "Official communications from WordPress will always come from a wordpress.org or wordpress.com email address." To know more about Read our full blog on Fake CVE Phishing Scam Tricks.

[govindhtech]

Decoding CISA Exploited Vulnerabilities

Integrating CISA Tools for Effective Vulnerability Management: Vulnerability management teams struggle to detect and update software with known vulnerabilities with over 20,000 CVEs reported annually. These teams must patch software across their firm to reduce risk and prevent a cybersecurity compromise, which is unachievable. Since it’s hard to patch all systems, most teams focus on fixing vulnerabilities that score high in the CVSS, a standardized and repeatable scoring methodology that rates reported vulnerabilities from most to least serious. 

However, how do these organizations know to prioritize software with the highest CVE scores? It’s wonderful to talk to executives about the number or percentage of critical severity CVEs fixed, but does that teach us anything about their organization’s resilience? Does decreasing critical CVEs greatly reduce breach risk? In principle, the organization is lowering breach risk, but in fact, it’s hard to know. 

To increase cybersecurity resilience, CISA identified exploited vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) initiative was created to reduce breaches rather than theoretical risk. CISA strongly urges businesses to constantly evaluate and prioritize remediation of the Known Exploited Vulnerabilities catalog. By updating its list, CISA hopes to give a “authoritative source of vulnerabilities that have been exploited in the wild” and help firms mitigate risks to stay ahead of cyberattacks.

CISA has narrowed the list of CVEs security teams should remediate from tens-of-thousands to just over 1,000 by focusing on vulnerabilities that: 

Been assigned a CVE ID and actively exploited in the wild

Have a clear fix, like a vendor update.

This limitation in scope allows overworked vulnerability management teams to extensively investigate software in their environment that has been reported to contain actively exploitable vulnerabilities, which are the most likely breach origins. 

Rethinking vulnerability management to prioritize risk

With CISA KEV’s narrower list of vulnerabilities driving their workflows, security teams are spending less time patching software (a laborious and low-value task) and more time understanding their organization’s resiliency against these proven attack vectors. Many vulnerability management teams have replaced patching with testing to see if: 

Software in their surroundings can exploit CISA KEV vulnerabilities.

Their compensatory controls identify and prevent breaches. This helps teams analyze the genuine risk to their organization and the value of their security protection investments.

This shift toward testing CISA KEV catalog vulnerabilities shows that organizations are maturing from traditional vulnerability management programs to Gartner-defined Continuous Threat Exposure Management (CTEM) programs that “surface and actively prioritize whatever most threatens your business.” This focus on proven risk instead of theoretical risk helps teams learn new skills and solutions to execute exploits across their enterprise.  

ASM’s role in continuous vulnerability intelligence  

An attack surface management (ASM) solution helps you understand cyber risk with continuous asset discovery and risk prioritization.

Continuous testing, a CTEM pillar, requires programs to “validate how attacks might work and how systems might react” to ensure security resources are focused on the most pressing risks. According to Gartner, “organizations that prioritize based on a continuous threat exposure management program will be three times less likely to suffer a breach.”

CTEM solutions strengthen cybersecurity defenses above typical vulnerability management programs by focusing on the most likely breaches. Stopping breaches is important since their average cost is rising. IBM’s Cost of a Data Breach research shows a 15% increase to USD 4.45 million over three years. As competent resources become scarcer and security budgets tighten, consider giving your teams a narrower emphasis, such as CISA KEV vulnerabilities, and equipping them with tools to test exploitability and assess cybersecurity defense robustness.

Checking exploitable vulnerabilities using IBM Security Randori

IBM Security Randori, an attack surface management solution, finds your external vulnerabilities from an adversarial perspective. It continuously validates an organization’s external attack surface and reports exploitable flaws.

A sophisticated ransomware attack hit Armellini Logistics in December 2019. After the attack, the company recovered fast and decided to be more proactive in prevention. Armellini uses Randori Recon to monitor external risk and update asset and vulnerability management systems as new cloud and SaaS applications launch. Armellini is increasingly leveraging Randori Recon’s target temptation analysis to prioritize vulnerabilities to repair. This understanding has helped the Armellini team lower company risk without affecting business operations.

In addition to managing vulnerabilities, the vulnerability validation feature checks the exploitability of CVEs like CVE-2023-7992, a zero-day vulnerability in Zyxel NAS systems found and reported by IBM X-Force Applied Research. This verification reduces noise and lets clients act on genuine threats and retest to see if mitigation or remediation worked. 

Read more on Govindhtech.com