A number of vulnerabilities have been exploited in Microsoft Teams by attackers through the use of GIFs. The attack technique has been named ‘GIFShell’, and allows the attackers to send malicious files, execute commands, and exfiltrate data from their victims. Affected versions of Microsoft Teams include version 1.5.00.11163 and earlier, where the exploited insecure design […]
Microsoft Teams Reverse Shell Attack Using GIFs Read More »
Four vulnerabilities in D-Link routers have been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog this week. Also included in this week’s catalogue updates were now-patched zero-day vulnerabilities in Google Chrome, and Photo Station QNAP software. Three of the D-Link vulnerabilities identified as exploited by their addition to this list
Actively Exploited Vulnerabilities in D-Link Devices Read More »
A security vulnerability has been identified in HP’s in-built software HP Support Assistant, that is present on all HP and Omen laptops and desktop computers. HP Support Assistant is pre-installed on all HP and Omen devices, so all users of these devices could be at risk. A security bulletin has been released this week by
HP Patch Escalation of Privilege Flaw Read More »
A critical vulnerability has been identified in multiple versions of Atlassian’s Bitbucket Server and Bitbucket Data Center. A recent advisory released by Bitbucket Support explains that all versions after 6.10.17, including 7.0.0 and later, have been affected by this flaw. However, this vulnerability is not present in Atlassian Cloud sites, so users who access Bitbucket
Critical Atlassian Bitbucket Vulnerability Read More »
GitLab have published a critical security release this week to notify their users about an update that contains important security fixes. Versions 15.3.1, 15.2.3, and 15.1.5 were released for GitLab Community Edition (CE) and Enterprise Edition (EE), in order to patch a remote code execution (RCE) vulnerability. GitLab is used as a DevOps platform for
GitLab Patch Critical Remote Code Execution Flaw Read More »
A denial-of-service vulnerability was identified this month in Palo Alto Networks PAN-OS software. This week, the Cybersecurity and Infrastructure Agency (CISA), a branch of the US government, have added this vulnerability to their list of known exploited vulnerabilities. Tracked as CVE-2022-0028, this flaw affects the URL filtering policy in multiple versions of PAN-OS running on
Palo Alto Networks Exploited in DoS Attacks Read More »
Apple have released a security update this week to patch two actively exploited zero-day vulnerabilities. Both of these flaws affect Macs using the macOS Monterey operating system, iPhone 6s and later generations, and all models of the iPad Pro. Updates for the operating systems of these affected devices were released on 17th August. Users should
Apple Fix Two Exploited Zero-Day Vulnerabilities Read More »
Google have released a security update this week for the Chrome desktop app for Windows, Mac, and Linux. This update patches 11 vulnerabilities, one of which is a zero-day flaw that is known to be exploited in the wild, and another has been given a critical severity rating. This is the fifth security update for
Chrome Update Fixes Critical and Zero-Day Flaws Read More »
Microsoft’s August patch Tuesday security update included fixes for 138 vulnerabilities, 17 of which were classified as ‘Critical’ flaws. The security patches issued cover 40 different Microsoft and Windows products and features, including critical Windows system operations, and popular applications such as Microsoft Edge, Microsoft Office, and the Microsoft Exchange Server. Two zero-day vulnerabilities were
Microsoft Patches Critical Zero-Day Vulnerabilities Read More »
Google Workspace and Microsoft 365 users have been targeted in phishing attacks that have resulted in the attackers stealing credentials. The attackers exploited known flaws in Snapchat and American Express websites to trigger open redirects to specially crafted web pages, where the credential harvesting could then take place. Email security company Inky detected these attacks
Amex and Snapchat used in Open Redirect Attacks Read More »
SecureTeam Ltd,
Kemp House, 152 City Road,
London,
EC1V 2NX
10257784
GB 249480968
SecureTeam Ltd, Kemp House, 152 City Road,
London, EC1V 2NX
Mon – Fri: 09:00 – 17:00
Company Number: 10257784
VAT Registration No: GB 249480968
© SecureTeam 2023. All rights reserved.