Google has released a Chrome 120 update to resolve six vulnerabilities, including four reported by external researchers.
The post Google Patches Six Vulnerabilities With First Chrome Update of 2024 appeared first on SecurityWeek.
New DLL Search Order Hijacking Technique Targets WinSxS folder
Attackers can abuse a new DLL search order hijacking technique to execute code in applications within the WinSxS folder.
The post New DLL Search Order Hijacking Technique Targets WinSxS folder appeared first on SecurityWeek.
Vulnerabilities in Google Kubernetes Engine Could Allow Cluster Takeover
Two flaws in Google Kubernetes Engine could be exploited to escalate privileges and take over the Kubernetes cluster.
The post Vulnerabilities in Google Kubernetes Engine Could Allow Cluster Takeover appeared first on SecurityWeek.
Critical Apache OFBiz Vulnerability in Attacker Crosshairs
Shadowserver sees possible in-the-wild exploitation of a critical Apache OFBiz vulnerability tracked as CVE-2023-49070.
The post Critical Apache OFBiz Vulnerability in Attacker Crosshairs appeared first on SecurityWeek.
In Other News: Crypto Exchange Hack Guilty Plea, Rating AI Vulnerabilities, Intellexa Spyware
Noteworthy stories that might have slipped under the radar: Cryptocurrency exchange hacker pleads guilty, rating LLM vulnerabilities, Intellexa spyware analysis.
The post In Other News: Crypto Exchange Hack Guilty Plea, Rating AI Vulnerabilities, Intellexa Spyware appeared first on SecurityWeek.
Ivanti Patches Dozen Critical Vulnerabilities in Avalanche MDM Product
Ivanti has patched 20 vulnerabilities in its Avalanche MDM product, including a dozen remote code execution flaws rated critical.
The post Ivanti Patches Dozen Critical Vulnerabilities in Avalanche MDM Product appeared first on SecurityWeek.
Google Rushes to Patch Eighth Chrome Zero-Day This Year
Google warns of in-the-wild exploitation of CVE-2023-7024, a new Chrome vulnerability, the eighth documented this year.
The post Google Rushes to Patch Eighth Chrome Zero-Day This Year appeared first on SecurityWeek.
Mozilla Patches Firefox Vulnerability Allowing Remote Code Execution, Sandbox Escape
Firefox and Thunderbird security updates released this week address multiple memory safety bugs in both products.
The post Mozilla Patches Firefox Vulnerability Allowing Remote Code Execution, Sandbox Escape appeared first on SecurityWeek.
Outlook Plays Attacker Tunes: Vulnerability Chain Leading to Zero-Click RCE
Akamai researchers document more vulnerabilities and patch bypasses leading to zero-click remote code execution in Microsoft Outlook.
The post Outlook Plays Attacker Tunes: Vulnerability Chain Leading to Zero-Click RCE appeared first on SecurityWeek.
CISA Flags Gaps in Healthcare Org’s Security Posture, Issues Security Guidance
The US cybersecurity agency CISA issues cybersecurity recommendations for the healthcare and public health sector.
The post CISA Flags Gaps in Healthcare Org’s Security Posture, Issues Security Guidance appeared first on SecurityWeek.
