security Archives Page 2720 of 27472 | Cyberthreat Blog from Fortify24x7

SynQuaNon Meeting

by Cyberthreat Blog | Dec 5, 2025 | NIST | 0 |

Program review for DARPA SynQuaNon program.

VU#441887: Duc contains a stack buffer overflow vulnerability in the buffer_get function, allowing for out-of-bounds memory read

by Cyberthreat Blog | Dec 5, 2025 | CERT-Vulnerabilities | 0 |

Overview Duc, an open-source disk management tool, contains a stack-based buffer overflow vulnerability allowing for out-of-bounds memory read. An attacker can exploit this vulnerability through malformed input data, and can...

AutoIT3 Compiled Scripts Dropping Shellcodes, (Fri, Dec 5th)

by Cyberthreat Blog | Dec 4, 2025 | SANS ISC Bulletins | 0 |

AutoIT3[1] is a powerful language that helps to built nice applications for Windows environments,...

Resources for Ransomware Risk Management

by Cyberthreat Blog | Dec 4, 2025 | NIST | 0 |

Ransomware is a persistent risk to organizations of all sizes and sectors, and addressing this risk requires collaboration across the public and private sectors to develop practical resources for organizations to reduce their...

Nation-State Attack or Compromised Government? [Guest Diary], (Thu, Dec 4th)

by Cyberthreat Blog | Dec 3, 2025 | SANS ISC Bulletins | 0 |

[This is a Guest Diary by Jackie Nguyen, an ISC intern as part of the SANS.edu BACS program] The...

Attempts to Bypass CDNs, (Wed, Dec 3rd)

by Cyberthreat Blog | Dec 3, 2025 | SANS ISC Bulletins | 0 |

Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup,...

A NICE Retrospective on Shaping Cybersecurity’s Future

by Cyberthreat Blog | Dec 2, 2025 | NIST | 0 |

Rodney Petersen has served as the Director of NICE at the National Institute for Standards and Technology (NIST) for the past eleven years where his focus has been on advancing cybersecurity education and workforce development....

[Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd)

by Cyberthreat Blog | Dec 1, 2025 | SANS ISC Bulletins | 0 |

[This is a Guest Diary by James Woodworth, an ISC intern as part of the SANS.edu Bachelor’s...

VU#633103: Insufficient Session Cookie Invalidation in nopCommerce ASP.NET Core eCommerce Platform

by Cyberthreat Blog | Dec 1, 2025 | CERT-Vulnerabilities | 0 |

Overview nopCommerce, an ecommerce platform, fails to invalidate session cookies upon user logout or session termination, enabling attackers to use the captured cookie to gain access to the application. This vulnerability is...

VU#521113: Forge JavaScript library impacted by a vulnerability in signature verification.

by Cyberthreat Blog | Nov 25, 2025 | CERT-Vulnerabilities | 0 |

Overview The Forge JavaScript library provides TLS-related cryptographic utilities. A vulnerability that allows signature verification to be bypassed through crafted manipulation of ASN.1 structures, particularly in fields such...

Conflicts between URL mapping and URL based access control., (Mon, Nov 24th)

by Cyberthreat Blog | Nov 24, 2025 | SANS ISC Bulletins | 0 |

We continue to encounter high-profile vulnerabilities that relate to how URL mapping (or “aliases”) interac|zsh:1: parse error near `&’ ts with URL-based access control. Last week, we wrote about the Oracle...

VU#649739: Lack of Sufficient Guardrails Lead to Excessive Agency (LLM08) in Some LLM Applications

by Cyberthreat Blog | Nov 24, 2025 | CERT-Vulnerabilities | 0 |

Overview Retell AI’s API creates AI voice agents that have excessive permissions and functionality, as a result of insufficient amounts of guardrails. As a result, attackers can exploit this and conduct large scale social...

Tag: security