| Date | Source | Type | Title | Author |
|---|---|---|---|---|
| May 30, 2024 | CISA | Alert | CISA Releases Seven Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-151-02 Fuji Electric Monitouch V-SFT ICSA-24-151-03 Inosoft VisiWin ICSA-24-151-04 Westermo EDW-100 ICSA-22-356-03 Mitsubishi Electric MELSEC iQ-R, iQ-L Series and MELIPC Series (Update C) ICSMA-24-151-01 Baxter Welch Allyn Configuration Tool ICSMA-24-151-02 Baxter Welch Allyn Connex Spot Monitor This product is provid… | CISA |
| May 30, 2024 | CISA | ICS Advisory | ICSA-24-151-01: LenelS2 NetBox Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute malicious commands with elevated permissions | CISA |
| May 30, 2024 | CISA | ICS Advisory | ICSA-24-151-03: Inosoft VisiWin Successful exploitation of this vulnerability could allow an attacker to gain SYSTEM privileges | CISA |
| May 30, 2024 | CISA | ICS Advisory | ICSA-24-151-04: Westermo EDW-100 Successful exploitation of these vulnerabilities could allow an attacker to access the device using hardcoded credentials and download cleartext username and passwords. | CISA |
| May 30, 2024 | CISA | ICS Medical Advisory | ICSMA-24-151-01: Baxter Welch Allyn Configuration Tool Successful exploitation of this vulnerability could lead to the unintended exposure of credentials to unauthorized users. | CISA |
| May 30, 2024 | CISA | ICS Medical Advisory | ICSMA-24-151-02: Baxter Welch Allyn Connex Spot Monitor Successful exploitation of this vulnerability could allow an attacker to modify device configuration and firmware data. Tampering with this data could lead to device compromise, resulting in impact and/or delay in patient care. | CISA |
| May 30, 2024 | CISA | ICS Advisory | ICSA-24-151-02: Fuji Electric Monitouch V-SFT (Update A) Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code. | CISA |
| May 30, 2024 | CERT-EU | Advisory | 2024-053: Zero-day Vulnerability in Check Point Security Gateways This high-severity information disclosure vulnerability can be exploited to gain unauthorised access to sensitive information on systems with remote Access VPN or Mobile Access Software Blades enabled [1]. It is recommended applying the hotfix and the extra protection measures provided by the vendor Tracked as CVE-2024-24919, the high-severity information disclosure vulnerability enables attackers to read certain information on internet-exposed C… | CERT-EU |
| May 28, 2024 | CISA | Alert | CISA Releases One Industrial Control Systems Advisory These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-149-01 Campbell Scientific CSI Web Server This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 28, 2024 | CISA | ICS Advisory | ICSA-24-149-01: Campbell Scientific CSI Web Server Successful exploitation of these vulnerabilities could allow an attacker to download files and decode stored passwords. | CISA |
| May 28, 2024 | CERT-EU | Advisory | 2024-052: Vulnerability in Cisco FMC Software If exploited, this vulnerability could allow an attacker to obtain any data from the database, execute arbitrary commands on the underlying operating system, and elevate privileges to root. The vulnerability CVE-2024-20360 [1], with a CVSS score of 8.8, lies in the web-based management interface of Cisco Firepower Management Center (FMC) Software. | CERT-EU, FMC |
| May 27, 2024 | CERT-EU | Advisory | 2024-051: Vulnerabilities in GitLab On May 22, GitLab has released several versions for GitLab Community Edition (CE) and Enterprise Edition (EE) containing important bug and security fixes [1]. These fixes notably address a vulnerability that would allow an attacker to take accounts over via an XSS vulnerability. It is strongly recommended upgrading affected versions to the latest version as soon as possible. | CERT-EU |
| May 24, 2024 | CISA | Alert | Cisco Releases May 2024 Cisco ASA, FMC, and FTD Software Security Publication Cisco released a bundled publication for security advisories that address vulnerabilities in Cisco Adaptive Security Appliance (ASA), Firepower Management Center (FMC), and Firepower Threat Defense (FTD) software. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. | CISA |
| May 23, 2024 | CISA | Alert | CISA Releases One Industrial Control Systems Advisory These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-144-01 AutomationDirect Productivity PLCs This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 23, 2024 | CISA | ICS Advisory | ICSA-24-144-01: AutomationDirect Productivity PLCs Successful exploitation of these vulnerabilities could lead to remote code execution and denial of service. | CISA |
| May 22, 2024 | CERT-EU | Advisory | 2024-046: Multiple Vulnerabilities in Git These vulnerabilities could allow for remote code execution and unauthorised file modifications. The vulnerability CVE-2024-32002 , with a CVSS score of 9.1, could allow a remote attacker to execute code on the affected device. | CERT-EU |
| May 22, 2024 | CERT-EU | Advisory | 2024-047: Critical Vulnerability in GitHub Enterprise Server OnMay 21, 2024, GitHubdisclosed acriticalvulnerability inGitHubEnterprise Server(GHES) impacting instances using SAML single sign-on (SSO) with encrypted assertions. This vulnerability allows attackers to forge SAML responses, granting unauthorised administrative access A proof of concept is publicly available. | CERT-EU |
| May 22, 2024 | CERT-EU | Advisory | 2024-048: Critical Vulnerability in Veeam Backup Enterprise Manager The vulnerability CVE-2024-29849, with a CVSS score of 9.8, could allow an unauthenticated attacker to login into the Veeam Backup Enterprise Manager web interface as any user. The flaw lies in the authentication mechanism of the web interface. | CERT-EU |
| May 22, 2024 | CERT-EU | Advisory | 2024-049: Multiple Vulnerabilities in QNAP Products These vulnerabilities could allow remote attackers to execute arbitrary code. It is strongly advised updating affected systems to the latest versions to mitigate these risks. | CERT-EU |
| May 22, 2024 | CERT-EU | Advisory | 2024-050: Multiple Vulnerabilities in Ivanti EPMM An attacker could exploit these flaws to execute arbitrary commands on the appliance. It is strongly advised updating affected systems to the latest versions to mitigate these risks. | CERT-EU |
| May 22, 2024 | NSA | Guidance | CSI: Advancing Zero Trust Maturity Throughout the Application and Workload Pillar Information Technology (IT) professionals are keenly aware of the security challenges facing applications, but workloads are every bit as important to consider in this domain. Workloads represent computational tasks, which encompass multiple programs or applications performing those tasks by utilizing computing, data, networking, and storage resources. | CISA, NSA |
| May 21, 2024 | CISA | Alert | Rockwell Automation Encourages Customers to Assess and Secure Public-Internet-Exposed Assets Rockwell Automation has released guidance encouraging users to remove connectivity on all Industrial Control Systems (ICS) devices connected to the public-facing internet to reduce exposure to unauthorized or malicious cyber activity. | CISA |
| May 21, 2024 | CISA | Alert | CISA Releases One Industrial Control Systems Advisory These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-142-01 LCDS LAquis SCADA This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 21, 2024 | CISA | ICS Advisory | ICSA-24-142-01: LCDS LAquis SCADA Successful exploitation of these vulnerabilities could allow an attacker to read and write files outside of their own directory. | CISA |
| May 16, 2024 | CERT-EU | Advisory | 2024-044: Zero-day Vulnerability in Chrome It has been reported that this vulnerability is beingactivelyexploited[1]. Google Chrome prior to version 125.0.6422.60/.61 for Windows and Mac, 125.0.6422.60 for Linuxareimpacted[1]. | CERT-EU |
| May 16, 2024 | FBI | Alert | Democratic People's Republic of Korea Leverages U.S.-Based Individuals to Defraud U.S. Businesses and Generate Revenue The Federal Bureau of Investigation (FBI) is warning the public and private sector of the threat posed to U.S. businesses by information technology (IT) workers from the Democratic People's Republic of Korea (North Korea). North Korea is evading U.S. and U.N. sanctions by targeting private companies to illicitly generate substantial revenue for the regime. | FBI |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-01: Siemens Parasolid Parasolid is affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the out of bounds read vulnerabilities to perform remote code execution in the context of the current process or denial of service condition in the application. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-03: Siemens Teamcenter Visualization and JT2Go Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious CGM or XML files. If a user is tricked to open a malicious file with the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-04: Siemens Polarion ALM The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-05: Siemens Simcenter Nastran Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a new version for Simcenter Nastran 2406 and recommends to update to the latest version. Siemens recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-06: Siemens SIMATIC CN 4100 SIMATIC CN 4100 is vulnerable to use of hard coded credentials including root user and contains an unrestricted USB port that could be misused for insecure boot. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-08: Siemens PS/IGES Parasolid Translator Component PS/IGES Parasolid Translator Component contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for PS/IGES Parasolid Translator Component and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-09: Siemens Solid Edge Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application is parsing PAR files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to execute arbitrary code in the context of the current process. Siemens has released a new version for Solid Edge and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-10: Siemens RUGGEDCOM CROSSBOW The RUGGEDCOM CROSSBOW server application before V5.5 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, or upload of arbitrary files to the application's file system. The majority of the reported vulnerabilities might have a high impact in the availability of the affected systems. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-11: Siemens RUGGEDCOM APE1808 Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before 23.4.1. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Nozomi Network's upstream security notifications. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-13: Siemens Industrial Products Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-12: Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems Several products used in Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems contain buffer overflow vulnerabilities in the network communication stack. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker, who gained access to the fire protection system network, to execute arbitrary code on the affected products (CVE-2024-22039) or create a denial of service condition (CVE-2024-22040, CVE-2024-22041). Product-specific impact of the individual vulnerabilities is documented in the chapter “Vulnerability Description”. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-07: Siemens SIMATIC RTLS Locating Manager Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-02: Siemens SICAM Products Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: - SICAM A8000 device firmwares - CPC80 for CP-8000/CP-8021/CP-8022 - CPCI85 and OPUPI0 for CP-8031/CP-8050 - SICAM EGS firmware - CPCI85 and OPUPI0 - SICAM 8 Software Solution - SICORE Siemens has released new versions for the affected firmwares and recommends to update to the latest versions. | CISA |
| May 16, 2024 | CISA | Alert | Cisco Releases Security Updates for Multiple Products Cisco has released security updates to address vulnerabilities in Cisco software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following advisories and apply necessary updates: • Cisco Crosswork Network Services Orchestrator • Cisco Crosswork Network Services Orchestrator Privilege Escalation • ConfD CLI Privilege Escalation and Arbitr… | CISA |
| May 16, 2024 | CISA | Alert | CISA Releases Seventeen Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-137-01 Siemens Parasolid ICSA-24-137-02 Siemens SICAM Products ICSA-24-137-03 Siemens Teamcenter Visualization and JT2Go ICSA-24-137-04 Siemens Polarion ALM ICSA-24-137-05 Siemens Simcenter Nastran ICSA-24-137-06 Siemens SIMATIC CN 4100 Before V3. | CISA |
| May 16, 2024 | CISA | ICS Advisory | ICSA-24-137-14: Rockwell Automation FactoryTalk View SE Successful exploitation of this vulnerability could allow an attacker to inject a malicious SQL statement in the SQL database, resulting in expose sensitive information. | CISA |
| May 15, 2024 | JPCERT/CC | Alert | Alert Regarding Vulnerabilities in Adobe Acrobat and Reader (APSB24-29) Vulnerabilities exists in Adobe Acrobat, a PDF file creation and conversion software, and Adobe Acrobat Reader, a PDF file viewing software. As a result, an attacker may execute arbitrary code by convincing a user to open contents leveraging the vulnerability. | JPCERT/CC |
| May 15, 2024 | CISA | Alert | Adobe Releases Security Updates for Multiple Products Adobe has released security updates to address vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following Adobe Security Bulletins and apply necessary updates: This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 14, 2024 | CISA | Alert | Microsoft Releases May 2024 Security Updates Microsoft has released security updates to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following advisory and apply the necessary updates: Microsoft Security Update Guide for May This product is provided subject to this Notification and this Privacy & Use policy. | CISA, JPCERT/CC |
| May 14, 2024 | NCSC | Guidance | Guidance for organisations considering payment in ransomware incidents This guidance has been jointly developed by the insurance industry bodies ABI, BIBA, IUA and the NCSC. It is for organisations experiencing a ransomware attack and the partner organisations supporting them. It aims to minimise the overall impact of a ransomware incident on an disruption and cost to businesses the number of ransoms paid by UK ransomware victims the size of ransoms where victims choose to pay The NCSC and the insurance industry bod… | NCSC-UK |
| May 14, 2024 | CERT-EU | Advisory | 2024-039: Critical Putty Client Vulnerability This vulnerability stems from a bias in ECDSA nonce generation when using the NIST P-521 elliptic curve. Attackers can exploit this bias to recover private keys after observing a relatively small PuTTY, when utilising the NIST P-521 elliptic curve, generates ECDSA nonces with the first 9 bits set to zero. | CERT-EU |
| May 14, 2024 | CISA | ICS Advisory | ICSA-24-135-04: Mitsubishi Electric Multiple FA Engineering Software Products (Update G) Multiple Vulnerabilities due to vulnerabilities in Jungo's WinDriver in multiple FA engineering software products. Successful exploitation of these vulnerabilities may allow a local attacker to cause a Windows blue screen error that results in a denial-of-service condition and/or to gain Windows system privileges and execute arbitrary commands. | CISA |
| May 14, 2024 | CISA | ICS Advisory | ICSA-24-135-01: Rockwell Automation FactoryTalk Remote Access Successful exploitation of this vulnerability could allow an attacker to enter a malicious executable and run it as a system user, resulting in remote code execution. | CISA |
| May 14, 2024 | CISA | ICS Advisory | ICSA-24-135-02: SUBNET PowerSYSTEM Center Successful exploitation of the vulnerabilities in components used by PowerSYSTEM Center could allow privilege escalation, denial-of-service, or arbitrary code execution. | CISA |
| May 14, 2024 | CISA | Alert | CISA and Partners Release Guidance for Civil Society Organizations on Mitigating Cyber Threats with Limited Resources The joint guidance provides civil society organizations and individuals with recommended actions and mitigations to reduce the risk of cyber intrusions. Additionally, the guide encourages software manufactures to actively implement and publicly commit to Secure by Design practices that are necessary to help protect vulnerable and high-risk communities. | CISA, DHS, FBI |
| May 14, 2024 | CISA | Alert | CISA Releases Four Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-135-01 Rockwell Automation FactoryTalk Remote Access ICSA-24-135-02 SUBNET PowerSYSTEM Center ICSA-24-135-03 Johnson Controls Software House C-CURE 9000 ICSA-24-135-04 Mitsubishi Electric Multiple FA Engineering Software Products This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 14, 2024 | CISA | Alert | Apple Releases Security Updates for Multiple Products A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following advisories and apply necessary updates: This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 14, 2024 | CISA | ICS Advisory | ICSA-24-135-03: Johnson Controls Software House C●CURE 9000 Successful exploitation of this vulnerability may allow an attacker to access credentials used for access to the application. | CISA |
| May 13, 2024 | NSA | Analysis Report | CTR: DoD Microelectronics: Field Programmable Gate Array Best Practices – Threat Catalog (May 2024 Update) Cybersecurity Technical Report Best Practices – Threat Catalog National Security Agency | Cybersecurity Technical Report DoD Microelectronics: FPGA Best Practices – Threat Catalog This document was created through collaboration with each of the JFAC labs: National Security Agency (NSA), Air Force Research Lab (AFRL) RYDT, Naval Surface Warfare Center (NSWC) Crane, and Army Development Command (DEVCOM)/AVMC. | NSA |
| May 10, 2024 | CISA | Alert | CISA and Partners Release Advisory on Black Basta Ransomware Today, CISA, in partnership with the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released joint Cybersecurity Advisory (CSA) #StopRansomware: Black Basta to provide cybersecurity defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) used by known Black Basta ransomware affiliates and identified thr… | CISA, CSA, FBI, HHS, MS-ISAC |
| May 10, 2024 | CISA | Advisory | #StopRansomware: Black Basta These #StopRansomware advisories include recently and historically observed tactics, Install updates for operating techniques, and procedures (TTPs) and indicators of systems, software, and firmware compromise (IOCs) to help organizations protect against as soon as they are released. | CISA, FBI, HHS, MS-ISAC |
| May 9, 2024 | CISA | Alert | ASD’s ACSC, CISA, and Partners Release Secure by Design Guidance on Choosing Secure and Verifiable Technologies Today, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), together with CISA, the Canadian Centre for Cyber Security (CCCS), the United Kingdom’s National Cyber Security Centre (NCSC-UK), and the New Zealand National Cyber Security Centre (NCSC-NZ) are releasing the following guidance: Secure by Design Choosing Secure and Verifiable Technologies . | ASD/ACSC, CCCS, CISA, NCSC-NZ, NCSC-UK |
| May 9, 2024 | CISA | Alert | CISA Releases Four Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-130-01 Rockwell Automation FactoryTalk Historian SE ICSA-24-130-02 alpitronic Hypercharger EV Charger ICSA-24-130-03 Delta Electronics InfraSuite Device Master ICSA-24-107-03 Rockwell Automation ControlLogix and GuardLogix (Update A) This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 9, 2024 | CISA | ICS Advisory | ICSA-24-130-03: Delta Electronics InfraSuite Device Master Successful exploitation of this vulnerability could allow remote code execution. | CISA |
| May 9, 2024 | CISA | ICS Advisory | ICSA-24-130-02: alpitronic Hypercharger EV charger Successful exploitation of this vulnerability could result in an attacker disabling the device, bypassing payment, or accessing payment data. | CISA |
| May 9, 2024 | CISA | ICS Advisory | ICSA-24-130-01: Rockwell Automation FactoryTalk Historian SE Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. | CISA |
| May 7, 2024 | CISA | Alert | CISA Releases Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-128-02 SUBNET Substation Server This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 7, 2024 | CISA | ICS Advisory | ICSA-24-128-02: SUBNET Substation Server Successful exploitation of the vulnerabilities in components used by Substation Server could allow privilege escalation, denial-of-service, or arbitrary code execution. | CISA |
| May 7, 2024 | CISA | ICS Advisory | ICSA-24-128-01: PTC Codebeamer Successful exploitation of this vulnerability could allow an attacker to inject malicious code in the application. | CISA |
| May 2, 2024 | CISA | ICS Advisory | ICSA-24-123-01: CyberPower PowerPanel Business Successful exploitation of these vulnerabilities could result in an attacker bypassing authentication and gaining administrator privileges, forging JWT tokens to bypass authentication, writing arbitrary files to the server and acheiving code execution, gaining access to services with the privileges of a Powerpanel Business application, gaining access to the testing or production server, learning passwords and authenticating with user or administrator privileges, injecting SQL syntax, writing arbitrary files to the system, executing remote code, impersonating any client in the system and… | CISA |
| May 2, 2024 | NSA | Alert | North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts Department of State, and the National Security Agency malicious activity: (NSA) are jointly issuing this advisory to highlight attempts by Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) Kimsuky cyber actors to exploit improperly configured DNS Domain-based Message Authentication, configurations found below. Reporting and Conformance (DMARC) record policies to conceal social engineering attempts. | FBI, NSA |
| May 2, 2024 | CISA | Alert | CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708 , CVE-2024-20345 ) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. | CISA, FBI |
| May 2, 2024 | CISA | Alert | CISA Releases Three Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-123-01 CyberPower PowerPanel ICSA-24-123-02 Delta Electronics DIAEnergie ICSA-24-067-01 Chirp Systems Chirp Access (Update C) This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 2, 2024 | CISA | ICS Advisory | ICSA-24-123-02: Delta Electronics DIAEnergie Successful exploitation of these vulnerabilities could allow an authenticated attacker with limited privileges to escalate privileges, retrieve confidential information, upload arbitrary files, backdoor the application, and compromise the system on which DIAEnergie is deployed. | CISA |
| May 1, 2024 | CISA | Alert | CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who seek to compromise industrial control systems (ICS) and small-scale operational technology (OT) systems in North American and European critical infrastructure sectors, including Water and Wastewater Systems, Dams, Energy, and Food and Agriculture Sectors. | CCCS, CISA, MS-ISAC, NCSC-UK, USDA |
| May 1, 2024 | CISA | Alert | CERT/CC Reports R Programming Language Vulnerability A cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the following advisories and apply the necessary updates: CERT/CC VU#23819 Hidden Layer Blog: R-Bitrary Code Execution--Vulnerability in R’s Deserialization Comprehensive R Archive Network This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 1, 2024 | NSA | Alert | Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity | CCCS, CISA, DOE, EPA, FBI, MS-ISAC, NCSC-UK, NSA, USDA |