Alerts and Advisories
Alerts & Advisories
Apache Tomcat Vulnerability in Dell OpenManage Server Administrator (CVE-2024-52316)
9 Jan 2025
Dell has released a critical security update for Dell OpenManage Server Administrator (OMSA) to address an Apache Tomcat Unchecked Error Condition Vulnerability.
Cisco Nexus Dashboard Fabric Controller (NDFC) Web UI Command Injection Vulnerability (CVE-2024-20432)
4 Oct 2024
Cisco has issued a security advisory addressing a critical vulnerability (CVE-2024-20432) in its Nexus Dashboard Fabric Controller (NDFC). This vulnerability could allow an authenticated, lowprivileged remote attacker to perform a command injection attack against an affected device.
Critical Vulnerability in PHP (CVE-2024-4577)
14 Aug 2024
A critical vulnerability in PHP, identified as CVE-2024-4577 has recently been published. This vulnerability could lead to remote command injection
Global IT Outage Caused by CrowdStrike Defective Update
19 Jul 2024
Recent major IT outages have impacted global users across sectors such as aviation, retail, communications, and banking. CrowdStrike has confirmed a widespread issue with its update causing Blue Screen of Death (BSOD) affecting Windows users. CrowdStrike is actively working on releasing an update to resolve the issue for machines with Windows and Falcon installed.
OpenSSH Vulnerability - regreSSHion: Remote Code Execution (CVE-2024-6387)
2 Jul 2024
A critical vulnerability known as regreSSHion (CVE-2024-6387), has been discovered in OpenSSH, a widely used open-source implementation for secure network communication. This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code with root privileges on Linux systems running OpenSSH servers.
Cisco ASA Devices Backdoored Via Two Zero-Days (CVE-2024-20353 and CVE-2024-20359)
1 May 2024
Cisco has warned that two zero-day vulnerabilities in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls are now actively exploited since November 2023 to breach government networks worldwide. The two vulnerabilities, namely CVE-2024-20353 and CVE-2024-20359, allow threat actors to deploy previously unknown malware and maintain persistence on compromised ASA and FTD devices.
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability (CVE-2023-32046)
29 Apr 2024
CVE-2023-32046 is a vulnerability in the Windows MSHTML platform that could lead to an Elevation of Privilege (EoP) – essentially allowing a low privilege attacker to execute code in the context of the user or gain high-level access to a system they ordinarily would not have. Exploitation of the vulnerability requires that a user open a specially crafted file.
Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2024-21410)
29 Apr 2024
CVE-2024-21410 is a critical vulnerability affecting Microsoft Exchange Server, with a severity score of 9.8. Successful exploitation of the flaw could permit an attacker to relay a user's leaked Net-NTLMv2 hash against a susceptible Exchange Server and authenticate as the user. This elevation of privilege vulnerability can be exploited by attackers to gain unauthorized access to affected systems. It is essential for organizations to apply appropriate mitigations to protect their systems from potential exploitation.
Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
26 Apr 2024
A critical command injection vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cisco ASA/FTD Vulnerability (CVE-2020-3259)
26 Apr 2024
A buffer tracking issue exists in Cisco firewalls when the software parses invalid URLs that are requested from the web services interface. By sending a crafted GET request to the web services interface, an unauthenticated, remote attacker could retrieve memory contents from an affected device.
Facebook Account Impersonating Pelita Brunei
18 Apr 2024
A new Facebook page impersonating Pelita Brunei is promoting fake monthly welfare assistance from the government of Brunei Darussalam (Bantuan Kebajikan Bulanan Kerajaan Brunei Darussalam).
Fake Message on Kurnia Peribadi (Personal Gift) from His Majesty the Sultan
21 Mar 2024
A fake message is being circulated via Telegram, encouraging the reader to register as a recipient of Kurnia Peribadi KDYMM (Personal Gift from His Majesty the Sultan and Yang Di-Pertuan of Brunei Darussalam) on the occasion of Hari Raya Aidilfitri. The message contains a link to a webpage which requests the user to enter their Telegram phone number and one-time password (OTP).