![]() |
Description: On Monday, the United Kingdom's privacy watchdog announced that it is investigating TikTok, Reddit, and Imgur because of privacy concerns about how they are processing children's data. [...]
March 3rd, 2025 (4 months ago)
|
CVE-2023-20118 |
Description: CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2023-20118 Cisco Small Business RV Series Routers Command Injection Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2024-4885 Progress WhatsUp Gold Path Traversal Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the cata...
CVSS: MEDIUM (6.5)
March 3rd, 2025 (4 months ago)
|
![]() |
Description: Lindy Cameron, CEO, introduces changes to the NCSC’s cyber security resources specifically designed for board members.
March 3rd, 2025 (4 months ago)
|
![]() |
Description: Ollie N explains the thinking behind the NCSC’s new Vulnerability Disclosure Toolkit, which is now available to download.
March 3rd, 2025 (4 months ago)
|
![]() |
Description: Explaining the forthcoming NCSC Technology Assurance Principles.
March 3rd, 2025 (4 months ago)
|
![]() |
Description: Impact
User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.
Patches
Upgrade to flask-appbuilder>=4.5.3
Workarounds
Downgrade werkzeug to <3.0.0
References
Are there any links users can visit to find out more?
References
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
https://github.com/advisories/GHSA-p8q5-cvwx-wvwp
March 3rd, 2025 (4 months ago)
|
![]() |
March 3rd, 2025 (4 months ago)
|
![]() |
Description: The Qilin ransomware group has claimed responsibility for the February 3, 2025, cyberattack on Lee Enterprises, which previously disrupted newspaper production, subscriber services, and financial operations across the media company’s network. In a statement to CyberInsider on February 3, 2025, Lee Enterprises confirmed they are investigating the situation, but did not have any further details …
The post Qilin Ransomware Gang Claims Lee Enterprises Attack, Threatens to Leak Stolen Data appeared first on CyberInsider.
March 3rd, 2025 (4 months ago)
|
![]() |
Description: A newly discovered botnet, Eleven11bot, has infected over 30,000 internet-connected devices and is being actively used in DDoS attacks against telecom providers and gaming platforms, causing prolonged disruptions. Identified by Nokia Deepfield’s Emergency Response Team (ERT), the botnet's attack activity has been traced primarily to Iran, although the compromised devices are distributed worldwide. A growing …
The post Massive DDoS Botnet Eleven11bot Infects 30,000+ IoT Devices appeared first on CyberInsider.
March 3rd, 2025 (4 months ago)
|
CVE-2023-20118 |
Description: Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
CVSS: MEDIUM (6.5)
March 3rd, 2025 (4 months ago)
|