%term

Understanding CVE-2024-47176: Mitigating CUPS Vulnerabilities

Oct 29, 2024 By UpGuard Team In UpGuard

The Common UNIX Printing System (CUPS) is a widely used printing system on Unix-like operating systems, but recent vulnerabilities have exposed significant risks. The most critical is CVE-2024-47176, which affects the cups-browsed service by binding to the IP address INADDR_ANY:631. This configuration flaw causes it to trust all incoming packets, leading to potential remote code execution when interacting with malicious printers. This vulnerability is part of a chain of exploits, including.

Read Post

UpGuard

Read more about Understanding CVE-2024-47176: Mitigating CUPS Vulnerabilities

The FortiManager RCE Vulnerability - The 443 Podcast - Episode 311

Oct 29, 2024 By WatchGuard In WatchGuard

This week on the podcast, we review Fortinet's recently-disclosed remote code execution vulnerability in the FortiManager system that has been under active exploit since at least June. After that, we discuss the SEC's recent action against 4 companies found at fault for misleading security incident disclosure statements. The 443 Security Simplified is a weekly podcast that gets inside the minds of leading white-hat hackers and security researchers, covering the latest cybersecurity headlines and trends.

View Video

WatchGuard

Read more about The FortiManager RCE Vulnerability - The 443 Podcast - Episode 311

Best Practices for Continuous Vulnerability Management

Oct 29, 2024 By Liran Tal In Snyk

Continuous vulnerability management is not just a best practice—it's a necessity. With so many open-source dependencies to choose from (almost 3 million on the npm registry!), it’s no wonder supply chain security incidents are the focus of malicious actors. Let’s not forget the rise of ChatGPT, LLM chatbots, and AI-assisted code generation.

Read Post

Snyk

Read more about Best Practices for Continuous Vulnerability Management

Top 5 SAST Auto-fixing Tools and How They Compare

Oct 29, 2024 By Liqian Lim () In Snyk

7 hours. That’s how long, on average, a developer takes to remediate a security issue in their code. Vulnerability detection is improving rapidly and scaling, but remediating security risks is still a tedious, time-consuming process that takes developers away from their core work. And now, with AI-generated code introducing vulnerabilities at greater speed and volume than ever before, remediation is taking even more time.

Read Post

Snyk

Read more about Top 5 SAST Auto-fixing Tools and How They Compare

The Essential Guide to Vulnerability Management Tools

Oct 29, 2024 By Amit Sheps In IONIX

Vulnerability management programs attempt to identify and correct software vulnerabilities before they pose a significant threat to an organization’s cybersecurity. To learn more about how to design and implement a vulnerability management program, check out these resources: This article describes the tools that an organization will need to implement an effective vulnerability management program.

Read Post

IONIX

Read more about The Essential Guide to Vulnerability Management Tools

Understanding CSRF and SSRF Attacks (Demo and Examples)

Oct 28, 2024 By Snyk In Snyk

In this video, we examine two critical web security vulnerabilities: CSRF (Cross-Site Request Forgery) and SSRF (Server-Side Request Forgery). Learn about each attack, how it differs, and why it poses serious risks to web applications.

View Video

Snyk

Read more about Understanding CSRF and SSRF Attacks (Demo and Examples)

Threat Context Monthly: Executive intelligence briefing for October 2024

Oct 28, 2024 By KrakenLabs In Outpost 24

Welcome to the Threat Context Monthly blog series where we provide a comprehensive roundup of the most relevant cybersecurity news and threat information from KrakenLabs, Outpost24’s cyber threat intelligence team. Here’s what you need to know from October.

Read Post

Outpost 24

Read more about Threat Context Monthly: Executive intelligence briefing for October 2024

An Update on Windows Downdate

Oct 26, 2024 By Alon Leviev In SafeBreach

In August, I shared a blog on my most recent research project called Windows Downdate, which I first presented at Black Hat USA 2024 and DEF CON 32 (2024). In it, I explained how I was able to develop a tool to take over the Windows Update process to craft custom downgrades on critical OS components to expose previously fixed vulnerabilities. By using this downgrade ability, I discovered CVE-2024-21302, a privilege escalation vulnerability affecting the entire Windows virtualization stack.

Read Post

SafeBreach

Read more about An Update on Windows Downdate

CVE-2024-47575: Critical Vulnerability in FortiNet FortiManager Under Active Exploitation

Oct 24, 2024 By Andres Ramos In Arctic Wolf

On October 23, 2024, Fortinet published an advisory disclosing an actively exploited vulnerability (CVE-2024-47575) affecting FortiManager and FortiManager Cloud. The critical-severity vulnerability can be exploited on FortiManager instances exposed to the internet via port 541. Successful exploitation could allow a remote, unauthenticated threat actor to execute arbitrary code or commands via specially crafted requests.

Read Post

Arctic Wolf

Read more about CVE-2024-47575: Critical Vulnerability in FortiNet FortiManager Under Active Exploitation

Find, auto-fix, and prioritize intelligently, with Snyk's AI-powered code security tools

Oct 24, 2024 By Liqian Lim () In Snyk

During the long-awaited Snyk Launch 2024, we announced the exciting general availability of Snyk Code's auto-fixing feature, DeepCode AI Fix, powered by our AI machine, DeepCode AI! To celebrate this milestone, let’s explore how Snyk’s AI-powered features differentiate our approach to application security. AI is on everyone's minds, along with its countless applications that offer a wide variety of solutions (and issues).

Read Post