News archive Page 39
918 articles · sorted newest first · page 39 of 39
Looking for a specific story? Search and filter the full archive.
Log4Shell, Explained: The Internet's Worst Week
CVE-2021-44228 turned a single misused feature in Apache Log4j2 — a Java logging library embedded almost everywhere — into one of the most widely exploited vulnerabilities ever recorded.
Outlook MonikerLink Bug Bypasses Protected View
CVE-2024-21413 let attackers bypass Outlook's Protected View sandbox with a single specially crafted hyperlink, leading to code execution and potential credential leakage. Patched in February 2024's Patch Tuesday.
PAN-OS GlobalProtect Zero-Day Gave Attackers Root
CVE-2024-3400, a maximum-severity command-injection flaw in Palo Alto Networks' PAN-OS GlobalProtect feature, was exploited in the wild before a patch existed — handing attackers root access to the perimeter firewall.
Inside Ivanti Connect Secure's Chained Zero-Days
CVE-2023-46805 and CVE-2024-21887, chained together, gave a suspected nation-state actor unauthenticated remote code execution on Ivanti Connect Secure and Policy Secure VPN gateways for weeks before patches.
Citrix Bleed: A Memory Leak That Bypassed MFA
CVE-2023-4966, known as Citrix Bleed, let attackers pull live session tokens straight out of NetScaler ADC and Gateway memory — hijacking already-authenticated sessions without needing a password or MFA code.
Cisco IOS XE Web UI Zero-Day: Mass Exploitation
CVE-2023-20198, a maximum-severity privilege-escalation flaw in Cisco IOS XE's web management interface, was exploited at mass scale before a patch existed — handing attackers full admin control of network infrastructure.