DefendEdge Cyber Security Blog
Vulnerability Summary for the Week of September 20, 2021
Original release date: September 27, 2021 High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info There were no high vulnerabilities recorded this week. Back to top Medium Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info ffmpeg — ffmpeg Buffer Overflow vulnerability in function…
VMware vCenter Server Vulnerability CVE-2021-22005 Under Active Exploit
Original release date: September 24, 2021 On September 21, 2021, VMware disclosed that its vCenter Server is affected by an arbitrary file upload vulnerability—CVE-2021-22005—in the Analytics service. A malicious cyber actor with network access to port 443 can exploit this vulnerability to execute code on vCenter Server. On September 24, 2021, VMware confirmed reports that…
Exchange/Outlook Autodiscover Bug Spills $100K+ Email Passwords
Hundreds of thousands of email credentials, many of which double as Active Directory domain credentials, came through to credential-trapping domains in clear text.
Critical Cisco Bugs Allow Code Execution on Wireless, SD-WAN
Unauthenticated cyberattackers can also wreak havoc on networking device configurations.
Apple Patches 3 More Zero-Days Under Active Attack
One of the bugs, which affects macOS as well as older versions of iPhones, could allow an attacker to execute arbitrary code with kernel privileges.
5 Tips for Achieving Better Cybersecurity Risk Management
Casey Ellis, founder, CTO and chairman of Bugcrowd, discusses a roadmap for lowering risk from cyberattacks most effectively.
100M IoT Devices Exposed By Zero-Day Bug
A high-severity vulnerability could cause system crashes, knocking out sensors, medical equipment and more.
FamousSparrow APT Wings in to Spy on Hotels, Governments
A custom “SparrowDoor” backdoor has allowed the attackers to collect data from targets around the globe.
Netgear SOHO Security Bug Allows RCE, Corporate Attacks
The issue lies in a parental-control function that’s always enabled by default, even if users don’t configure for child security.
Unpatched Apple Zero-Day in macOS Finder Allows Code Execution
All a user needs to do is click on an email attachment, and boom — the code is silently executed without the victim knowing. It affects Big Sur and prior versions of macOS.