#vulnerability

#CVE Foundation just dropped a FAQ.

https://www.thecvefoundation.org/frequently-asked-questions

Also, just FYI, I’ve been helping with the Foundation setup and goals articulation and logistics for the last few weeks. I didn’t expect we’d pull the trigger on being public this week, precisely, but here we are!

I’m not employed there or anything (I work at @runZeroInc) but since I care about CVE, I want to do what I can to make sure it thrives and we don’t wind up back again with 15 competing standards for #vulnerability tracking if USG funding goes poof! one day (or other single-source-funding style disasters).

Anyway, back to my ill-timed family vacation. I’ll be more online next week. :)

The Cisco Webex app apparently has a Client-Side Remote Code Execution Vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-client-rce-ufyMMYLC
#webex #cybersecurity #vulnerability #cisco

As part of the 2022 EU NIS2 directive, the EU agency for cybersecurity (ENISA) has been setting up the EU Vulnerability Database (EUVD) at https://euvd.enisa.europa.eu/ (now in beta).

Started as a collaboration with MITRE's authoritative CVE database, EUVD may now end up replacing it, as US funding for the CVE database has stopped.

#enisa #euvd #cve #mitre #cybersecurity #vulnerability

Critical unauthenticated remote code execution flaw reported in Erlang/OTP SSH
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-unauthenticated-remote-code-execution-flaw-reported-in-erlang-otp-ssh-1-g-c-z-7/gD2P6Ple2L

Windows NTLM flaw (CVE-2025-24054) is under active exploitation! Learn how this critical vulnerability impacts your security and what you can do to stay safe.

#CyberSecurity #InfoSec #ThreatIntel #Vulnerability #WindowsSecurity #CVE #ZeroDay #SecurityNews

Learn more: https://zerodaily.me/blog/2025-04-18-windows-ntlm-cve-2025-24054-under-active-exploitation

we talk about ssh with @jtk and bam there is this

https://vulnerability.circl.lu/vuln/CVE-2025-32433#sightings

“SSH server (Erlang) may allow an attacker to perform unauthenticated remote code execution (RCE).”

We should be careful when we talk.

#vulnerability #ssh #erlang

‘Our moral intuitions about merit and personal worth are changing.’

an interview with Marion Fourcade about her book "The Ordinal Society" co-written by @kjhealy: https://news.berkeley.edu/2024/04/23/from-uber-ratings-to-credit-scores-whats-lost-in-a-society-that-counts-and-sorts-everything/

#TheOrdinalSociety #concentration #merit #meritocracy #MarionFourcade #Fourcade #school #credit #scores #scoring #reward #rewards #sociology #psychology #socioPsych #socioPsychology #ranking #selfWorth #universalism #digitalization #inequality #inequalities #recognition #data #AIRisks #AIEthics #gaming #socialization #Tracking #surveillance #power #socialControl #governance #regulation #rules #socialMedia #attention #reintermediation #intermediation #enshittification #risk #derisking #vulnerability #morality #confidence #trust #dataDon

@owasp calls for a new #federated system for tracking and reporting on #vulnerabilities.

https://owasp.org/blog/2025/04/17/owasp-global-vulnerability-intelligence.html

#vulnerability #cybersecurity #security #infosec

CVE-2025-24054, NTLM Exploit in the Wild

A critical vulnerability, CVE-2025-24054, related to NTLM hash disclosure via spoofing, has been actively exploited since March 19, 2025. The flaw allows attackers to leak NTLM hashes or user passwords using a maliciously crafted .library-ms file, potentially compromising systems. A campaign targeting government and private institutions in Poland and Romania used malspam to distribute Dropbox links containing archives exploiting this vulnerability. The exploit can be triggered with minimal user interaction, such as right-clicking or navigating to the folder containing the malicious file. This vulnerability appears to be a variant of the previously patched CVE-2024-43451, sharing several similarities.

Pulse ID: 680034fc84efc0751b3bc07d
Pulse Link: https://otx.alienvault.com/pulse/680034fc84efc0751b3bc07d
Pulse Author: AlienVault
Created: 2025-04-16 22:53:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Dropbox #Government #InfoSec #MalSpam #Nim #OTX #OpenThreatExchange #Password #Passwords #Poland #Spam #Vulnerability #Word #bot #AlienVault

Five GNA register to Global CVE (GCVE) allocation system vuldb.com, Ericsson PSIRT, EACG, SCHUTZWERK and DFN-CERT.

If you want to join and get a unique identifier
https://gcve.eu/about/#eligibility-and-process-to-obtain-a-gna-id

#cve #gcve #cybersecurity #vulnerability

@nborboen @pft

Vulnerabilituy-Lookup, gcve and the EUVD are somehow linked. See this question of the FAQ:
https://gcve.eu/faq/#q12-what-is-the-relationship-between-the-open-source-vulnerability-lookup-project-the-euvd-european-union-vulnerability-database-and-gcveeu

Vulnerability-Lookup is the backend of EUVD. Source code:
https://github.com/vulnerability-lookup/vulnerability-lookup

And it has its own instance with more features:
https://vulnerability.circl.lu

#cve #cvd #Vulnerability

Some Lessons learned from the tabletop exercise of continuing our top-tier #vulnerability #intelligence post "CVE" at #Cytidel

● We still have capability to monitor different Social media platforms and trusted expert sources for vulnerability info impacting products
● Collection of News, blogs, CSIRT updates are still fit to serve purpose
● Following vendor feeds directly is a big win as with sourcing info from primary source

Why The CVE Database Is Beyond Important To Cybersecurity and the World. Note: check out the video for a presentation on this one!

Edit: Funding has been extended for a while but this is still a critical issue. It's clear that no single source should be funding this critical project.

#News #TechNews #MITRE #CVE #Cybersecurity #Vulnerability #USA

https://youtu.be/-psdhAJINXc

Daily podcast: Why The CVE Database Is Beyond Important To Cybersecurity and the World. Note: check out the video for a presentation on this one!

Edit: Funding has been extended for a while but this is still a critical issue. It's clear that no single source should be funding this critical project.

#News #TechNews #MITRE #CVE #Cybersecurity #Vulnerability #USA #podcast

https://soundcloud.com/nickaesp/cve

I asked "TomGPT" to render the desk of a vulnerability management analyst if funding goes away for the CVE. #cve #vulnerability #humour

Researchers claim breakthrough in fight against AI’s frustrating #security hole

In the #AI world, a #vulnerability called "prompt injection" has haunted developers since #chatbots went mainstream in 2022. Despite numerous attempts to solve this fundamental vulnerability—the digital equivalent of whispering secret instructions to override a system's intended behavior—no one has found a reliable solution. Until now, perhaps.
#promptinjection

https://arstechnica.com/information-technology/2025/04/researchers-claim-breakthrough-in-fight-against-ais-frustrating-security-hole/

You can now share your thoughts on vulnerability CVE-2025-39581 in Vulnerability-Lookup:
https://vulnerability.circl.lu/vuln/CVE-2025-39581

themifyme - Themify Shortcodes

#VulnerabilityLookup #Vulnerability #Cybersecurity #bot

Critical authentication bypass and OS command injection flaws in Mitsubishi Electric smartRTU
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-and-os-command-injection-flaws-in-mitsubishi-electric-smartrtu-8-5-t-t-q/gD2P6Ple2L

You know when you see news articles about hacks of password databases or critical vulnerabilities in popular software, they usually quote a "CVE" number that officially identified the issue and allowed it to be defined precisely, and tracked? Well that's gone as of today. Looks like the trump regime has cancelled one off the foundational authorities on cybersecurity, the CVE or Common Vulnerabilities and Exposures program, without explanation. Basically the whole of "tech" relies on this, but I guess it's just America supporting the rest of the world, so it has to go. #cybersecurity #cybersec #cve #vulnerability #VulnerabilityDatabase

Edits: typos/autocorrupt

Critical security vulnerabilities patched in Google Chrome
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-security-vulnerabilities-patched-in-google-chrome-9-i-0-8-s/gD2P6Ple2L