Each week, Cyberwrites publishes a summary of cybersecurity news that compiles important vulnerabilities and exploits that may have gone unnoticed.
Our weekly vulnerability roundup will provide coverage of newly discovered vulnerabilities, as well as those exploited to compromise organizations.
Weekly Vulnerability Roundup
Cisco
Cisco has published a security advisory that states that they have discovered two vulnerabilities, an XSS and an HTML injection vulnerability.
These vulnerabilities existed in the SPA500 series of the Cisco Small Business IP Phones. Cisco confirmed that there had been no workarounds for fixing these vulnerabilities.
In addition to this, Cisco mentioned that they wouldn’t be releasing security patches for these vulnerabilities as the Cisco Small Business SPA500 Series IP Phones reached the end-of-life process on August 13, 2018.
Oracle
Oracle has released a list of security patches for more than 130+ products. These products were used in several industries, including banking, communication, enterprise, development, and others.
Over 508 new security patches and CVE IDs were released, of which 76 of them had Critical severity.
Apache OpenMeeting
OpenMeetings is an application that can be used for video calls, collaborative work, and presentations.
The newly discovered vulnerability could allow threat actors to execute commands on the underlying server.
OpenSSH Agent
This flaw exists in OpenSSH’s forward ssh-agent. This flaw allows an attacker to execute arbitrary commands on vulnerable OpenSSH’s forwarded ssh-agent.
OpenSSH has been used in several servers and applications for remote login and file transfer, along with encryption. This vulnerability exists in the ssh-agent program that allows authentication to remote servers without entering the passphrase every time.
Chrome 115 Update
Google released Chrome 115 to the stable channel for Windows, MacOS, and Linux on Tuesday, patching 20 vulnerabilities, including 11 that were discovered by external researchers.
Four security issues were assessed to be of “high severity,” while six were determined to be of “medium severity.
Zimbra and Roundcube Exploited
An alarming spear-phishing campaign has been uncovered, specifically aimed at government organizations. This attack preys on the vulnerabilities of Zimbra and Roundcube email servers.
These emails evaded government organizations’ anti-spam filters, which state that the threat actors used several evasion techniques to bypass spam detections.
Citrix NetScaler
Citrix recently issued a security bulletin, cautioning users about three new vulnerabilities impacting their above-mentioned product line.
The CVE-2023-3519 as the critical zero-day vulnerability among the three, enabling unauthenticated attackers to execute code on vulnerable Gateway systems remotely.