Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

Snyk welcomes Helios, accelerating our ASPM vision with runtime insights

Jan 16, 2024 By Manoj Nair In Snyk

As applications and their software supply chains become more complex, designing an AppSec program that is agile enough to keep pace, while still providing a clear, enterprise-wide view of risk requires a deep understanding of applications — depth that covers every line of code and package from development all the way to their live, running state.

Read Post
indusface

Critical Apache OFBiz Zero-day AuthBiz (CVE-2023-49070 and CVE-2023-51467)

Jan 16, 2024 By Meerjada Altamas In Indusface
Cybersecurity researchers recently uncovered a critical flaw in the widely used Apache OFBiz Enterprise Resource Planning (ERP) system, CVE-2023-51467. The zero-day vulnerability CVE-2023-51467 poses a significant threat, boasting a CVSS score of 9.8. This authentication bypass vulnerability stems from an incomplete patch for a previously disclosed Pre-auth Remote Code Execution (RCE) vulnerability, CVE-2023-49070.
Read Post
Arctic Wolf

CVE-2024-21887 and CVE-2023-46805: Actively Exploited Vulnerabilities in Ivanti Secure Products Chained Together to Achieve Unauthenticated RCE

Jan 16, 2024 By Steven Campbell In Arctic Wolf
In mid-December 2023, Volexity observed UTA0178–a potential Chinese nation-state threat actor–leveraging two zero-day vulnerabilities in Ivanti Connect Secure (formerly known as Pulse Connect Secure) VPN appliances to steal configuration data, modify and download files, establish a reverse tunnel, and ultimately place webshells (GLASSTOKEN) on multiple internal and external-facing web servers.
Read Post
Arctic Wolf

CVE-2024-20272: Critical Unauthenticated Arbitrary File Upload Vulnerability in Cisco Unity Connection

Jan 16, 2024 By Steven Campbell In Arctic Wolf
On January 10, 2024, Cisco disclosed a critical vulnerability, CVE-2024-20272, with a CVSS score of 7.3, in their Cisco Unity Connection software. This vulnerability allows an unauthenticated remote attacker to upload arbitrary files and execute commands on the underlying operating system. Cisco has released a patch to address the issue.
Read Post
kroll

Two Zero-Day Vulnerabilities Impacting Ivanti Connect Secure and Policy Secure Gateways

Jan 15, 2024 By George Glass In Kroll

Note: These vulnerabilities remain under active exploitation, and Kroll experts are investigating. If further details are uncovered by our team, updates will be made to the Kroll Cyber Risk blog. Two zero-day vulnerabilities have been discovered in Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure and Ivanti Policy Secure gateways.

Read Post
tripwire

Critical flaw found in WordPress plugin used on over 300,000 websites

Jan 15, 2024 By Graham Cluley In Tripwire
A WordPress plugin used on over 300,000 websites has been found to contain vulnerabilities that could allow hackers to seize control. Security researchers at Wordfence found two critical flaws in the POST SMTP Mailer plugin. The first flaw made it possible for attackers to reset the plugin's authentication API key and view sensitive logs (including password reset emails) on the affected website. A malicious hacker exploiting the flaw could access the key after triggering a password reset.
Read Post
seal security

NYDFS Finalizes Amendments to Cybersecurity Regulations: Adapting to New Requirements for Financial Services Companies

Jan 14, 2024 By Itamar Sher In Seal Security
On March 1, 2017 the Department of Financial Services (DFS) introduced a regulation, known as 23 NYCRR 500, establishing cybersecurity requirements for financial services companies. This regulation, enacted by the New York State Department of Financial Services, specifically Part 500 of Title 23 of the Official Compilation of Codes, Rules and Regulations of the State of New York (NYCRR) is commonly known as the "Cybersecurity Requirements for Financial Services Companies".
Read Post

Snyk and ServiceNow

Jan 13, 2024 By Snyk In Snyk
Looking for a complete view of your application security posture to drive smarter, faster fixes in your ServiceNow workflows? ServiceNow workflows, backed by Snyk, provide a single view into all application vulnerabilities from multiple sources, determine their priority, and help expedite the remediation process with relevant stakeholders across the organization to reduce the attack surface. Working together with AppSec and IT teams, learn how SecOps teams can track vulnerabilities in open source dependencies and create ServiceNow Application Vulnerable Items (AVITs) automatically.
View Video
upguard

Connect Secure No More: Ivanti's Zero-Day Vulnerabilities (CVE-2024-21887 and CVE-2023-46805)

Jan 12, 2024 By Caitlin Postal In UpGuard
Two chainable zero-day vulnerabilities face Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS): CVE-2023-46805 and CVE-2024-21887. All supported versions of the Ivanti Connect Secure and Policy Secure Gateways are currently at risk, and Ivanti has confirmed that customers have experienced active exploitation. ICS was previously known as Pulse Connect Secure. ICS offers a virtual private network (VPN) gateway, while IPS provides network access control.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.