vulnerabilities
A CVSS 9,8 bug that lets attackers spoof legitimate connectors between Microsoft/Azure services is the pick of the bunch...
"Loaded by default on just about every version of Windows, so it provides a broad attack surface"
SolarWinds’ poor controls... false and misleading statements and omissions, and the other misconduct... would have violated the federal securities laws even if SolarWinds had not experienced a major, targeted cybersecurity attack"
Here's what you need to do to reduce the threat posed by CVE-2023-4966. But don't delay.
Despite the low sophistication of the group’s toolset, it is a threat to governments in Europe because... a significant number of internet-facing applications are not regularly updated although they are known to contain vulnerabilities.”
"We have also seen devices... getting the implant successfully installed through an as of yet undetermined mechanism."
A CVSS 9.8, pre-auth RCE that lets an attacker execute arbitrary code without user interaction is wormable on systems where Message Queuing is enabled.
Do you, or do you not, need to get your knickers in a twist? Well, that depends on your risk tolerance..
A study out of Germany has highlighted shortcomings in the CVSS system and the way security vulnerabilities are assessed and scored