CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
Fortinet: FortiGate config leaks are genuine but misleading
Source: TheRegister
January 17th, 2025 (6 months ago)
Lynx Spa Has Fallen Victim to MORPHEUS Ransomware
Description: Lynx Spa Has Fallen Victim to MORPHEUS Ransomware
Source: DarkWebInformer
January 17th, 2025 (6 months ago)
A Threat Actor is Allegedly Selling the Data of Multiple German Shopping Databases
Description: A Threat Actor is Allegedly Selling the Data of Multiple German Shopping Databases
Source: DarkWebInformer
January 17th, 2025 (6 months ago)
A Threat Actor Claims to have Leaked the Data of Banco Bradesco
Description: A Threat Actor Claims to have Leaked the Data of Banco Bradesco
Source: DarkWebInformer
January 17th, 2025 (6 months ago)
CISA and FBI Release Updated Guidance on Product Security Bad Practices
Description: In partnership with the Federal Bureau of Investigation (FBI), CISA released an update to joint guidance Product Security Bad Practices in furtherance of CISA’s Secure by Design initiative. This updated guidance incorporates public comments CISA received in response to a Request for Information, adding additional bad practices, context regarding memory-safe languages, clarifying timelines for patching Known Exploited Vulnerabilities (KEVs), and other recommendations. While this voluntary guidance is intended for software manufacturers who develop software products and services in support of critical infrastructure, all software manufacturers are strongly encouraged to avoid these product security bad practices. CISA and FBI urge software manufacturers to reduce customer risk by prioritizing security throughout the product development process. For more information and resources, visit CISA’s Secure by Design webpage or learn how to take CISA’s Secure by Design Pledge.
Source: All CISA Advisories
January 17th, 2025 (6 months ago)
Clock ticking for TikTok as US Supreme Court upholds ban
Source: TheRegister
January 17th, 2025 (6 months ago)

CVE-2024-48460
[tabby-ssh] Eugeny Tabby Sends Password Despite Host Key Verification Failure
Description: An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails. References https://nvd.nist.gov/vuln/detail/CVE-2024-48460 https://github.com/Eugeny/tabby/issues/9955 https://github.com/Eugeny/tabby/commit/1c077147acd0a6ec9f8ee80d83a3e9688fbb9444 https://github.com/advisories/GHSA-8vq4-8hfp-29xh

EPSS Score: 0.04%

Source: Github Advisory Database (NPM)
January 17th, 2025 (6 months ago)
[nbgrader] nbgrader's `frame-ancestors: self` grants all users access to formgrader
Description: Impact Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enable_subdomains = False. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has full access to the contents of the page served by formgrader using Bob's credentials. Workarounds Disable frame-ancestors: self, or enable per-user and per-service subdomains with JupyterHub.enable_subdomains = True (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame). References JupyterHub documentation on why and when frame-ancestors: self is insecure, and why it was disabled by default: https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors References https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m https://github.com/jupyter/nbgrader/pull/1915 https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325 https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html https://github.com/advisories/GHSA-fcr8-4r9f-r66m
Source: Github Advisory Database (PIP)
January 17th, 2025 (6 months ago)
Behind the Blog: The TikTok Ban and Joyless AI
Description: This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we discuss joylessness in the AI industry and the TikTok ban.
Source: 404 Media
January 17th, 2025 (6 months ago)
US sanctions Chinese firm, hacker behind telecom and Treasury hacks
Description: The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned Yin Kecheng, a Shanghai-based hacker for his role in the recent Treasury breach and a company associated with the Salt Typhoon threat group. [...]
Source: BleepingComputer
January 17th, 2025 (6 months ago)