Month: June 2024

​Cox Communications has fixed an authorization bypass vulnerability that enabled remote attackers to abuse exposed backend APIs to reset millions of modems’ settings and steal customers’ sensitive personal information. Cox is the largest private broadband company in the U.S., providing internet, television, and phone services over fiber-powered networks to almost seven million homes and businesses…

A massive trove of 361 million email addresses from credentials stolen by password-stealing malware, in credential stuffing attacks, and from data breaches was added to the Have I Been Pwned data breach notification service, allowing anyone to check if their accounts have been compromised. Cybersecurity researchers collected these credentials from numerous Telegram cybercrime channels, where the…

​Security researchers at Tenable discovered what they describe as a high-severity vulnerability in Azure Service Tag that could allow attackers to access customers’ private data. Service Tags are groups of IP addresses for a specific Azure service used for firewall filtering and IP-based Access Control Lists (ACLs) when network isolation is needed to safeguard Azure…

Cloud security is a crucial component of the digital era. With that in mind, the National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) collaborated to issue five joint cybersecurity bulletins on best practices aimed at enhancing security for cloud services. These bulletins address critical aspects such as identity and access management, key…

Researchers have published a proof-of-concept (PoC) exploit script demonstrating a chained remote code execution (RCE) vulnerability on Progress Telerik Report Servers. The Telerik Report Server is an API-powered end-to-end encrypted report management solution organizations use to streamline the creation, sharing, storage, distribution, and scheduling of reports. Cybersecurity researcher Sina Kheirkha developed the exploit with the…