Category: alerts

Original release date: May 11, 2022 Summary Tactical actions for MSPs and their customers to take today: • Identify and disable accounts that are no longer in use. • Enforce MFA on MSP accounts that access the customer environment and monitor for unexplained failed authentication. • Ensure MSP-customer contracts transparently identify ownership of ICT security… Read more

Original release date: May 9, 2022 | Last revised: May 10, 2022 Microsoft has released a security advisory to address a remote code execution vulnerability affecting Azure Data Factory and Azure Synapse Pipelines. A remote attacker could exploit this vulnerability to take control of an affected system.  CISA encourages users and administrators to review Microsoft… Read more

Original release date: May 10, 2022 CISA and the Federal Bureau of Investigation (FBI) have updated the joint cybersecurity advisory, Strengthening Cybersecurity of SATCOM Network Providers and Customers, originally released March 17, 2022, with U.S. government attribution to Russian state-sponsored malicious cyber actors. The United States assesses Russia launched cyberattacks in late February against commercial… Read more

The bug has a severe rating of 9.8, public exploits are released. Read more

A huge spike in fraudulent activities related to attacks leveraging business email accounts is a billion-dollar-problem. Read more

Original release date: May 5, 2022 Cisco has released security updates to address multiple vulnerabilities in Enterprise NFV Infrastructure Software. An attacker could exploit these vulnerabilities to take control of an affected system.   CISA encourages users and administrators to review Cisco advisory cisco-sa-NFVIS-MUL-7DySRX9 and apply the necessary updates. For updates addressing lower severity vulnerabilities, see… Read more

The vulnerability is ‘critical’ with a CVSS severity rating of 9.8 out of 10. Read more

Original release date: May 4, 2022 F5 has released security advisories on vulnerabilities affecting multiple products, including various versions of BIG-IP. Included in the release is an advisory for CVE-2022-1388, which allows undisclosed requests to bypass the iControl REST authentication in BIG-IP. An attacker could exploit CVE-2022-1388 to take control of an affected system. CISA… Read more

A flaw in all versions of the popular C standard libraries uClibe and uClibe-ng can allow for DNS poisoning attacks against target devices. Read more

Original release date: May 2, 2022   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info jfinalcms_project — jfinalcms JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. 2022-04-22 7.5 CVE-2022-27341 MISC link-admin_project — link-admin Link-Admin v0.0.1 was discovered to contain a SQL injection… Read more