Security Leftovers
-
SANS ☛ A Vuln is a Vuln, unless the CVE for it is after Feb 12, 2024, (Wed, Apr 17th)
The NVD (National Vulnerability Database) announcement page (https://nvd.nist.gov/general/news/nvd-program-transition-announcement) indicates a growing backlog of vulnerabilities that are causing delays in their process.
& -
Security Week ☛ Cisco: Multiple VPN, SSH Services Targeted in Mass Brute-Force Attacks
Cisco has observed an increase in brute-force attacks targeting web application authentication, VPNs, and SSH services.
-
Security Week ☛ Ivanti Patches 27 Vulnerabilities in Avalanche MDM Product
Ivanti releases patches for 27 vulnerabilities in the Avalanche MDM product, including critical flaws leading to command execution.
-
OpenSSF (Linux Foundation) ☛ Beyond Scores with OpenSSF Scorecard: Granular Structured Results for Custom Policy Enforcement
OpenSSF Scorecard is a tool to help open source projects reduce software supply-chain risks. Scorecard analyzes projects against a series of heuristics and generates scores from 0–10 for the project — 0 meaning that the project employs high-risk practices and 10 meaning that the project follows security best practices.
-
Security Week ☛ Oracle Patches 230 Vulnerabilities With April 2024 CPU
Oracle releases 441 new security patches to address 230 vulnerabilities as part of its April 2024 Critical Patch Update.
-
Security Week ☛ Exploitation of Palo Alto Firewall Vulnerability Picking Up After PoC Release
Palo Alto Networks firewall vulnerability CVE-2024-3400 increasingly exploited after PoC code has been released.
-
Hubbard Broadcasting ☛ NYS Legislature’s bill drafting office is dealing with cyberattack
The New York State Legislature’s bill drafting office is dealing with a cyberattack.
State officials reported their system has been down since early Wednesday morning. According to the New York Times, Gov. Kathy Hochul says this could stall operations and workers might have to use computer systems that are nearly 30 years old.
This comes as the legislature moves toward finalizing the state budget, which is now 17 days late. Right now, investigators are working to determine who’s responsible and why they did it.