GitLab Security Flaw Let Attackers Inject Malicious Scripts: Patch Now

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

GitLab has announced the release of updated versions for both its Community Edition (CE) and Enterprise Edition (EE), addressing critical vulnerabilities that could potentially allow attackers to inject malicious scripts and cause denial of service (DoS) attacks. The versions released—16.10.1, …

Multiple Splunk Vulnerabilities Attackers Bypass SPL Safeguards : Patch Now

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Splunk Inc. has disclosed two significant vulnerabilities within its software suite, posing a considerable risk to organizations utilizing Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities, identified as CVE-2024-29945 and CVE-2024-29946, have been rated high in severity with CVSS scores …

Thread Hijacking: Phishes That Prey on Your Curiosity

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

Thread hijacking attacks. They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. These missives draw on the recipient’s natural curiosity about being copied …

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report that highlights the growing, widespread use and potential of Web3 user security data to aid in risk management. The findings of the report reveal a clear and …

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such as BMW Group, Daimler Truck AG, Marelli, NTT Data, Siemens, and Valeo, among others. C2A Security’s DevSecOps Platform, ‘EVSec’, has …

Apple ID “push bombing” Attack Targeting Apple Users to Steal passwords

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Apple users are falling prey to a sophisticated phishing campaign designed to hijack their Apple IDs through what’s known as a “push bombing” or “MFA fatigue” attack. This method exploits the multi-factor authentication (MFA) system, bombarding users with incessant notifications …

Hackers Using Weaponized Virtual Hard Disk Files to Deliver Remcos RAT

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Hackers have been found leveraging weaponized virtual hard disk (VHD) files to deploy the notorious Remote Control Software (RAT), Remcos. This method marks a significant evolution in cyberattack strategies, aiming to bypass traditional security measures and gain unauthorized access to …

NVIDIA ChatRTX For Windows App Vulnerability Let Attackers Escalate Privilege

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A security update released by ChatRTX on March 26th, 2024, addresses two vulnerabilities (CVE-2024-0082 and CVE-2024-0083) that could allow attackers to execute malicious code and tamper with data on affected systems.  The vulnerabilities stem from improper input validation (CWE-20) and …

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A new threat has emerged, targeting unsuspecting iPhone users through the seemingly secure iMefofferssage platform. A sophisticated Phishing-as-a-Service (PhaaS) platform known as ‘Dracula’. This platform has been implicated in high-profile phishing attacks, leveraging the trust and widespread use of iMessage …

2 Chrome Zero-Days Exploited At Pwn2Own 2024 : Patch Now

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Google patched seven vulnerabilities in the Chrome browser on Tuesday, including two zero-day exploits that were exploited at the Pwn2Own Vancouver 2024 hacking contest. Researchers at Pwn2Own challenge exploited the zero-days tagged as Type Confusion in WebAssembly (CVE-2024-2887) and Use …