OATH Toolkit pam_oath usersfile ${HOME} privilege escalation (CVE-2024-47191) https://lists.nongnu.org/archive/html/oath-toolkit-help/2024-10/msg00001.html

A critical vulnerability in Adobe Commerce and Magento platforms, dubbed “CosmicSting”, is actively being exploited by threat actors targeting online stores globally.
https://socradar.io/cosmicsting-cve-2024-34102-vulnerability-under-active-exploitation/

Security researchers reveal hacking campaign focused on Adobe Commerce and Magento online stores

Two vulnerabilities, tracked as CVE-2024-34102 and CVE-2024-2961, can be chained to achieve remote code execution. The threat actors behind the campaign are stealing cryptographic keys and inject skimmers to steal credit cards.

Administrators are advised to patch ASAP

#cybersecurity

https://www.bleepingcomputer.com/news/security/over-4-000-adobe-commerce-magento-shops-hacked-in-cosmicsting-attacks/

#LiteSpeed has released software updates to address a vulnerability in its Cache plugin for #WordPress

The vulnerability is tracked as CVE-2024-47374, and when exploited, allows an attacker to run arbitrary JavaScript code

Administrators are advised to patch ASAP

#cybersecurity #vulnerabilitymanagement

https://thehackernews.com/2024/10/wordpress-litespeed-cache-plugin.html

Analysis of CVE-2024-21310: Pool Overflow Windows Cloud Filter Driver

https://gabrieldurdiak.github.io/clfd/

#infosec #windows

Hey Ted, have you ever thought about rewriting it in rust?

e2fsprogs (1.46.2-2+deb11u1) bullseye-security; urgency=medium

* Non-maintainer upload by the LTS Team.
* CVE-2022-1304: e2fsck out-of-bounds read/write

Thousands of Linux systems infected by stealthy malware since 2021
https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/

Thousands of machines running Linux have been infected by a malware strain
that’s notable for its stealth, the number of misconfigurations it can
exploit, and the breadth of malicious activities it can perform, researchers
reported Thursday.

The malware has been circulating since at least 2021. It gets installed by
exploiting more than 20,000 common misconfigurations, a capability that may
make millions of machines connected to the Internet potential targets,
researchers from Aqua Security said. It can also exploit CVE-2023-33246, a
vulnerability with a severity rating of 10 out of 10 that was patched last
year in Apache RocketMQ, a messaging and streaming platform that’s found on
many Linux machines.

Una vulnerabilidad crítica en GitLab expone autenticación SAML, mientras que aspiradoras robóticas Deebot presentan fallas de seguridad que comprometen la privacidad. Además, el malware Perfctl sigue acechando a sistemas Linux y una nueva falla en Havoc C2 podría facilitar ataques. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 05/10/24 📆 |====

```
🔓 VULNERABILIDAD CRÍTICA EN GITLAB

Un análisis detallado de la vulnerabilidad CVE-2024-45409 revela que las bibliotecas Ruby-SAML y OmniAuth-SAML tienen fallas que permiten a los atacantes eludir la autenticación SAML en GitLab. Esto podría resultar en accesos no autorizados. ¡Infórmate sobre cómo proteger tu información! 👉 https://djar.co/MoNDI

🤖 FALLAS DE SEGURIDAD EN ASPIRADORAS ROBOT

A pesar de advertencias previas, la principal empresa de robótica doméstica sigue sin abordar problemas de seguridad en sus aspiradoras robot Deebot. Esto deja a usuarios expuestos, permitiendo que atacantes puedan acceder a sus cámaras en tiempo real. Descubre más detalles aquí 👉 https://djar.co/Bmiqe

🐧 MALWARE PERMANENTE EN LINUX

El malware Perfctl ha infiltrado miles de sistemas Linux desde 2021, manteniéndose indetectable y complicando su eliminación. Esta amenaza persistente subraya la importancia de la detección proactiva en seguridad cibernética. Conoce cómo identificarlo y proteger tus sistemas 👉 https://djar.co/SdubfU

⚠️ VULNERABILIDAD EN HAVOC C2

Una nueva vulnerabilidad en Havoc C2 permite a atacantes no autenticados crear sockets TCP en servidores, lo que puede resultar en filtraciones de IP y redirección del tráfico. Es crucial que los administradores de sistemas revisen esta falla para mitigar riesgos. Lee más sobre esto 👉 https://djar.co/zypf6

🔍 MEJORAS EN MICROSOFT SECURITY COPILOT

Se analizan los avances logrados por Microsoft Security Copilot seis meses después de su lanzamiento. Aunque ha mostrado mejoras, persisten ciertas limitaciones que podrían afectar su eficacia en la protección de datos. Conoce los detalles de estas actualizaciones 👉 https://djar.co/t02lN

🌐 CUMBRE VIRTUAL DE SEGURIDAD RESPONSABLE

No te pierdas el GenAI Powered Responsible Security Virtual Summit 2024, donde aprenderás sobre hiperautomatización y su impacto en la gestión de alertas y mejora de la postura de seguridad. Un evento clave para todos los profesionales del sector. Descubre más aquí 👉 https://djar.co/20I9

🇺🇦 PREOCUPACIONES DE SEGURIDAD NACIONAL EN UCRANIA

Funcionarios ucranianos han manifestado su preocupación sobre TikTok como una amenaza para la seguridad nacional, contrastándolo con Telegram, que ya controla el mercado. La estrategia de medios digitales se vuelve esencial en el contexto actual. Infórmate sobre este tema crítico 👉 https://djar.co/8aXzt
```

🚨PoC CVE-2024-45519 - Zimbra Postjournal Exploit

https://darkwebinformer.com/poc-cve-2024-45519-zimbra-postjournal-exploit/

Exploiting Visual Studio via dump files - #CVE-2024-30052: https://ynwarcs.github.io/exploiting-vs-dump-files

Security researchers reveal hacking campaign focused on Adobe Commerce and Magento online stores

Two vulnerabilities, tracked as CVE-2024-34102 and CVE-2024-2961, can be chained to achieve remote code execution. The threat actors behind the campaign are stealing cryptographic keys and inject skimmers to steal credit cards.

Administrators are advised to patch ASAP

#cybersecurity

https://www.bleepingcomputer.com/news/security/over-4-000-adobe-commerce-magento-shops-hacked-in-cosmicsting-attacks/

Foxit Reader has a serious use-after-free vulnerability (CVE-2024-28888) that allows attackers to execute arbitrary code by embedding malicious JavaScript in a specially crafted PDF, requiring user interaction.
https://socradar.io/foxit-reader-vulnerability-cve-2024-28888-poc-code-released-patch-to-prevent-attacks/

Apple released iOS 18.0.1 and iPadOS 18.0.1 updates to fix two vulnerabilities, respectively tracked as CVE-2024-44207 and CVE-2024-44204, which exposed passwords and audio snippets to attackers.
https://securityaffairs.com/169381/mobile-2/apple-ios-18-0-1.html

Apple released iOS 18.0.1 and iPadOS 18.0.1 updates to fix two vulnerabilities, respectively tracked as CVE-2024-44207 and CVE-2024-44204, which exposed passwords and audio snippets to attackers.
https://securityaffairs.com/169381/mobile-2/apple-ios-18-0-1.html

@silmathoron Seemingly, yes. GrapheneOS claims that CVE-2024-32896 is the same as CVE-2024-29748 (https://www.bleepingcomputer.com/news/security/google-fixes-two-pixel-zero-day-flaws-exploited-by-forensics-firms/) - "CVE-2024-29745 refers to a vulnerability in the fastboot firmware used to support unlocking/flashing/locking," explained GOS on Twitter.

@silmathoron Seemingly, yes. GrapheneOS claims that CVE-2024-32896 is the same as CVE-2024-29748 (https://www.bleepingcomputer.com/news/security/google-fixes-two-pixel-zero-day-flaws-exploited-by-forensics-firms/) - "CVE-2024-29745 refers to a vulnerability in the fastboot firmware used to support unlocking/flashing/locking," explained GOS on Twitter.

@silmathoron Seemingly, yes. GrapheneOS claims that CVE-2024-32896 is the same as CVE-2024-29748 (https://www.bleepingcomputer.com/news/security/google-fixes-two-pixel-zero-day-flaws-exploited-by-forensics-firms/) - "CVE-2024-29745 refers to a vulnerability in the fastboot firmware used to support unlocking/flashing/locking," explained GOS on Twitter.