Summary: January 10, 2024, Ivanti published an advisory regarding two vulnerabilities (CVE-2023-46805 and CVE-2024-21887) that impact all supported versions of the Connect Secure (formerly known as Pulse Connect Secure) and Policy Secure gateways. CVE-2023-46805 is… More »
Summary: Apache disclosed a critical vulnerability (CVE-2023-50164) in the Apache Struts 2 open-source framework. Successful exploitation can allow an attacker to manipulate file upload parameters to enable path traversal and upload a malicious file. The… More »
Summary: Our Security Partner (Secureworks Counter Threat Unit researchers) are aware of at least two incidents where affiliates of the LockBit ransomware group have exploited the Citrix Bleed vulnerability (CVE-2023-4966) to access environments. It is… More »
Summary: On October 16, 2023, Cisco disclosed a critical privilege escalation vulnerability (CVE-2023-20198) that affects the web user interface (web UI) used in Cisco IOS XE software. Cisco observed this vulnerability being actively exploited since… More »
Summary: On July 18, 2023, Citrix disclosed multiple vulnerabilities (CVE-2023-3519, CVE-2023-3466, CVE-2023-3467) that impact NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Only customer-managed platforms are affected. CVE-2023-3519 is under active exploitation… More »
Summary: On May 31, 2023, Progress Software disclosed a critical vulnerability that impacts the MOVEit Transfer web application, which transfers files. Exploitation can lead to the deployment of a web shell and exfiltration of data.… More »
Summary: As identified by Jisc, one of our trusted support partners a pair of vulnerabilities have been identified in PaperCut MF/NG print solutions. ZDI-CAN-18987 allows an attacker to bypass authentication on a vulnerable PaperCut Application… More »
Summary: Our Security Partner, Jisc is currently investigating multiple incidents of business email compromise (BEC) leading to financial fraud. These incidents are targeting both high-value and lower-level user accounts with particular focus on those linked… More »
Summary: In late October 2022, reports emerged of an impending OpenSSL update for a critical vulnerability. On November 1, OpenSSL version 3.0.7 was released to address two high-severity buffer overflow vulnerabilities (CVE-2022-3602 and CVE-2022-3786) impacting… More »
