A SharePoint flaw shipped as a moderate spoofing issue in August. Six weeks later it was exploited as remote code execution. It needed any account and a server that would answer.
5 min read
F5 disclosed an unauthenticated code execution flaw in BIG-IP APM on 22 September and confirmed it was already exploited. The affected configuration is the one acting as an OAuth authorization server.
5 min read
ESET says a China-aligned espionage group reached governments across Latin America by exploiting publicly reachable Exchange servers. No CVE was named. The first step was still reachability.
5 min read
WSO2 patched a pre-authentication JWT bypass in May. On 13 September, watchTowr reported forged administrator tokens arriving at its honeypot network. The four months in between were a reachability problem.
5 min read
An attacker's own open directory exposed an intrusion at a Thai broadband provider, including eight scripts written to fingerprint one SSL-VPN appliance running firmware older than the flaw aimed at it.
5 min read
An unauthenticated PAN-OS flaw gives root on hardware firewalls, with no workaround. The advisory scores it lower where the management interface answers only trusted addresses.
5 min read
Cisco Talos tied real intrusions to remote access against Secure FMC. The management interface had a smaller legitimate audience than the internet.
5 min read
A pre-authentication code execution flaw in F5 BIG-IP APM has been exploited since March. Sophos published an implant that survives upgrade images, and 795 devices were still exposed on 7 September.
5 min read
Microsoft fixed an Exchange authentication bypass on 11 August. Working exploit code is now circulating, and the flawed endpoint sits on servers that answer the whole internet because that is how staff get their mail.
4 min read