GitLab patched a CVSS 10.0 code execution flaw in the same CI/CD regex engine that produced two 9.9s nineteen days earlier. Those needed an account. This one needs nobody to sign in.
5 min read
SonicWall fixed a pre-authentication SSRF in the SMA1000 WorkPlace portal on 6 October, with no workaround. Three days later a honeypot network recorded attempts.
5 min read
September's fifteen cases ran from Exchange to France's tax agency. In ten, the vendor, a national agency or the reporting firm gave the same advice: restrict who can reach the service.
6 min read
The FBI says the FortiBleed campaign is still running against internet-facing Fortinet devices. No vulnerability is involved, and the best fix the advisory offers is the one a VPN gateway cannot take.
5 min read
Atlassian's interim advice for an unauthenticated file read in every version of eight self-hosted products is to take the instance off the internet.
5 min read
Citrix scored the flaw availability-only. An administrator found authentication usernames carrying shell commands that fetched a payload and ran it. Nobody has reconciled the two.
5 min read
CISA gave federal agencies until 4 October to remediate an unauthenticated FortiMail flaw already under exploitation. Fortinet's fixed builds were still listed as upcoming.
5 min read
Cisco disclosed a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that is already under attack, and stated that no workaround exists. What was left was its hardening guidance.
5 min read
France's tax administration lost data on hundreds of thousands to valid staff passwords at a portal that asked for nothing else. Three of the missed signals described where the connection came from.
5 min read