Blog

The latest news and developments

Explore a blend of security news, industry developments, and in-depth technical analysis of our services on Secora Consulting's blog. Bookmark this page to stay informed.

Latest Blogs and News

Secora Consulting’s blog is a mixture of news and developments in the security world and technical breakdowns of our services. Bookmark this page to stay informed.

Cybersecurity Alert

Red Hat Discloses Critical OpenPrinting CUPS Vulnerabilities Affecting RHEL

Red Hat has recently disclosed several critical vulnerabilities within OpenPrinting CUPS , an open-source printing system widely used across modern Linux distributions, including Red Hat Enterprise Linux (RHEL). These vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, and CVE-2024-47177) pose a significant security risk, particularly if exploited in combination. Understanding the Vulnerabilities OpenPrinting CUPS is essential for managing, discovering, and sharing printers across Linux systems. However, if these vulnerabilities are exploited together, attackers could potentially achieve remote code execution, leading to the theft of sensitive data or damage to critical production systems.

Cybersecurity Alert

High-Risk Vulnerability in Ivanti CSA Demands Immediate Patch Action

A critical security vulnerability, CVE-2024-8963, has been discovered in Ivanti’s Cloud Services Appliance (CSA) version 4.6 . The flaw, which has a high CVSS score of 9.4, was addressed incidentally in the patch released on September 10, 2024 (Patch 519). However, it remains a significant risk for organisations that have not yet applied this update. Understanding CVE-2024-8963 This vulnerability allows remote unauthenticated attackers to exploit the system by accessing restricted functionality.

Cyber Advisory

Is Your Organisation Ready for NIS2? Take Our Free Readiness Questionnaire

With the new NIS2 Directive set to impact businesses across multiple sectors, the need to enhance security and compliance has never been more pressing. But how confident are you that you’re fully prepared? Our NIS2 Readiness Questionnaire is here to help. This high-level questionnaire is designed to evaluate your current cybersecurity capabilities and uncover key areas for improvement. You’ll also receive a personalised score with actionable recommendations to enhance your security controls.

Vulnerability

Critical Vulnerabilities in Red Hat OpenShift Container Platform 4

Red Hat has recently disclosed two critical vulnerabilities in OpenShift Container Platform 4 that require urgent attention from affected organisations. The vulnerabilities, identified as CVE-2024-45496 and CVE-2024-7387, both have critical CVSS3.0 scores, highlighting their severity. CVE-2024-45496: Privilege Misuse in Build Process This flaw, with a CVSS score of 9.9, occurs due to the misuse of elevated privileges during the build process of OpenShift Container Platform. Specifically, the git-clone container is run with a privileged security context, granting unrestricted access to the node.

Cybersecurity Alert

Critical RCE Vulnerabilities in Veeam Backup and Replication and Veeam ONE Agent

Veeam has disclosed two critical vulnerabilities that pose significant risks to users of its Backup and Replication software and ONE Agent. These flaws, tracked as CVE-2024-40711 and CVE-2024-42024, could allow unauthenticated attackers to execute arbitrary code remotely, putting affected systems at risk. CVE-2024-40711 – Veeam Backup and Replication (CVSS: 9.8) This critical vulnerability, present in Veeam Backup and Replication versions 12.1.2.172 and earlier, allows remote code execution (RCE) via a deserialisation of untrusted data.

News

Critical Security Vulnerability in Google Chrome

Google Chrome users are being urged to update their browsers immediately due to a critical security vulnerability identified as CVE-2024-7971 . This vulnerability, known as a type confusion flaw, affects the V8 JavaScript and WebAssembly engine within Google Chromium versions prior to 128.0.6613.84. The flaw allows a remote attacker to exploit heap corruption through a specially crafted HTML page, making it a significant threat with a CVSS score of 8.8 (High).