vulnerabilities

Malware & Threats

Issued by: Dark Reading

The Black Basta ransomware emerged last month to target Windows-based systems only, but now the latest ransomware binary is going after VMware virtual machines (VMs). The latest variant looks to encrypt VMs present inside the volumes folder (/vmfs/volumes) on ESXi-based systems and servers, according to research shared with Dark Reading by Uptycs. It uses the…

Malware & Threats

Issued by: Dark Reading

Our nation is facing some of the most daunting cybersecurity challenges in history. As the new Office of the National Cyber Director (ONCD) gets fully staffed and running, little is more important to the nation’s security than making sure the right people are in the right places to address these dynamic challenges. Bringing private industry…

Vulnerabilities

Issued by: Dark Reading

CyberCatch today announced the publication of its quarterly Small and Medium-Sized Businesses Vulnerabilities Report (SMBVR) for Q1 2022 to alert small and medium-sized businesses (SMBs) to an alarming rise in vulnerabilities detected in Internet-facing websites, servers and applications. Of greatest concern, CyberCatch’s SMBVR has detected – for the first time in the report’s history —…

Mobile Security

Issued by: Security Week

According to an advisory released Friday by the Microsoft 365 Defender Research Team, a total of four documented vulnerabilities were found – and fixed – in a mobile framework owned by mce Systems, an Israeli company that provides software to mobile carriers. “Coupled with the extensive system privileges that pre-installed apps have, these vulnerabilities could…

Vulnerabilities

Issued by: Security Week

The vulnerability, tracked as CVE-2022-22972, affects VMware Workspace ONE Access, Identity Manager and vRealize Automation. It allows a malicious actor who has network access to the UI to bypass authentication. Shortly after VMware released patches, the US Cybersecurity and Infrastructure Security Agency (CISA) warned that threat actors would “quickly develop a capability to exploit CVE-2022-22972,”…

Application Security

Issued by: Security Week

High profile supply chain attacks like SolarWinds, Kaseya, Codecov, ua-parser-js and Log4j have put pressure on companies and governments to address the risks associated with open source and other software supply chain risks. President Biden’s May 2021 Executive Order includes supply chain attacks as an area of concern. More recently, on January 13, 2022, a…

Network Security

Issued by: CIO Security

As organizations grow, functions that started as one person’s job get split across multiple organizational units and multiple executives, often without thoughtful planning. Specialization enables experts to dig deep into each job but creates several problems: A lack of a single accountable executive (or worse, having multiple executives, each of whom manages part of the…

Software Security

Issued by: CIO Security

It’s more difficult than ever to protect our infrastructure, government, and businesses from becoming victims of well-funded, skilled adversaries. From the Log4j vulnerability to the SolarWinds hack to the Colonial Pipeline cyberattack, organizations are more vulnerable to cyberattacks than ever before. In fact, 87% of enterprises across 11 countries have fallen victim to cyberattacks in…