Overview On January 29, 2025, Microsoft disclosed a significant security vulnerability affecting its Microsoft Account infrastructure. Designated as CVE-2025-21396, this flaw arises from missing authorization checks, enabling unauthorized attackers to elevate their privileges over a network. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level. Vulnerability Details CVE ID: CVE-2025-21396 Description: The vulnerability stems from inadequate authorization mechanisms within the Microsoft Account system, allowing unauthorized attackers to escalate privileges over a network....
Overview On January 14, 2025, Microsoft disclosed CVE-2025-21298, a critical vulnerability affecting Windows OLE technology. Assigned a CVSS score of 9.8, this zero-click vulnerability enables attackers to execute arbitrary code on a victim’s system without user interaction, simply through email preview. Vulnerability Details CVE ID: CVE-2025-21298 Description: The vulnerability resides in the UtOlePresStmToContentsStm function within the ole32.dll library. This function is responsible for converting data in an “OlePres” stream into the appropriate format and inserting it into the “CONTENTS” stream within an OLE storage....
Microsoft Intune’s Conditional Access policies are designed to enforce compliance and protect enterprise environments by ensuring only managed and compliant devices can access corporate resources. However, security researchers at Jumpsec Labs have demonstrated a technique to bypass these restrictions, raising concerns about the effectiveness of Intune’s enforcement mechanisms. This article explores how the TokenSmith method enables adversaries to sidestep device compliance checks and what security teams can do to mitigate such risks....
In the realm of DevSecOps, integrating Static Application Security Testing (SAST) into Continuous Integration/Continuous Deployment (CI/CD) pipelines is a proactive approach to identifying vulnerabilities early in the software development lifecycle. While the ideal scenario envisions seamless detection and remediation of security flaws, the reality often involves navigating a series of complex challenges. Expectation vs. Reality The expectation is straightforward: a developer commits code, the CI pipeline initiates a security scan, detects vulnerabilities, and halts the process until issues are resolved, thereby preventing the release of insecure code....
Multi-factor authentication (MFA) is considered a cornerstone of modern security, with widespread adoption across enterprises and platforms. Despite its effectiveness in mitigating traditional threats like password compromise, recent advancements in attack strategies reveal critical weaknesses. One such method, dubbed “AuthQuake,” demonstrates how attackers can bypass MFA by exploiting weaknesses in implementation and user behavior. Understanding the AuthQuake Attack The AuthQuake attack represents a new wave of bypass techniques targeting MFA systems....
A recently discovered critical vulnerability, CVE-2024-10979, in PostgreSQL has raised serious concerns within the cybersecurity community. This flaw allows attackers to exploit database misconfigurations, potentially leading to unauthorized access to sensitive data. PostgreSQL, one of the most widely used open-source relational database systems, is at the center of this alarming issue. Overview PostgreSQL, one of the most popular open-source relational database systems, is under scrutiny due to a critical vulnerability, CVE-2024-10979, discovered recently....
The Advanced Packaging Tool (APT) is a powerful command-line utility in Debian-based Linux distributions, like Debian and Ubuntu, for managing software packages. APT simplifies package management by handling dependencies, downloading, installing, updating, and removing packages efficiently. Through APT, users can install software directly from trusted repositories on the internet, keeping their systems secure and up-to-date. Why Use APT? APT is essential for maintaining a stable and secure Linux environment. It allows for seamless updates to system software and dependencies, ensuring compatibility across packages and reducing manual configuration....
Introduction In today’s rapidly evolving cybersecurity landscape, attackers have found new ways to bypass multi-factor authentication (MFA) and compromise user sessions through tactics such as session hijacking and infostealer malware. These techniques pose significant risks to organizations and users, even those who have deployed MFA solutions to secure their systems. ...
Wazuh is an open-source cybersecurity platform that combines Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) to deliver comprehensive protection across endpoints, cloud workloads, and network devices. Its integrated approach allows organizations to monitor, detect, and respond to threats in real time, leveraging a flexible, scalable solution without licensing fees. Wazuh’s Community and Ecosystem One of Wazuh’s major strengths is its vibrant community and ecosystem, which contribute to its continuous improvement and growth....
Overview A critical security flaw, CVE-2024-3596, was recently discovered in the RADIUS (Remote Authentication Dial-In User Service) authentication protocol. This vulnerability, dubbed Blast-RADIUS, poses a serious threat to organizations relying on RADIUS for network authentication and access control. Researchers have demonstrated how attackers could exploit the vulnerability to bypass authentication mechanisms, highlighting the risks in environments using non-EAP (Extensible Authentication Protocol) methods over UDP. Vulnerability Details CVE ID: CVE-2024-3596 Description: The Blast-RADIUS attack allows an adversary to perform a Man-in-the-Middle (MITM) attack on RADIUS authentication....