Data & infrastructure
-
PaperCut attacks expose pre-authentication route
PaperCut is responding to active attacks against NG and MF after researchers reproduced a pre-authentication route from configuration manipulation to arbitrary code execution.
-
Plesk flaws break hosting tenant boundaries
Two Plesk vulnerabilities can expose other customers’ databases and server files, turning ordinary hosting accounts into a route towards cross-tenant access and administrative compromise.
-
Ubiquiti discloses 22 UniFi security flaws
Ubiquiti has published a 22-part security bulletin covering UniFi products, including critical vulnerabilities capable of command execution and privilege escalation on network infrastructure.
-
Dutch NCSC flags serious DrayTek flaws
Dutch cyber authorities are urging DrayTek VigorAP and VigorSwitch users to update after warning that serious flaws could expose network devices to takeover, disruption, or data access.
-
Apollo breach exposes cloud identity risk
Apollo Global Management says a social-engineering incident gave attackers access to cloud platforms for several days and exposed sensitive personal information.
-
Zimbra flaw moves into active exploitation
Attackers are exploiting a Zimbra Collaboration command-injection vulnerability that can allow unauthenticated remote command execution on servers with specific SNMP functionality enabled.
-
Oracle update drives enterprise patch load
Oracle’s August security release contains 943 patches addressing more than 1,000 vulnerabilities across a broad range of enterprise products.
-
Leaked Stripe keys expose merchant accounts
Researchers have validated hundreds of exposed Stripe merchant API keys with access to payment and customer functions, without evidence of a Stripe platform breach.
-
Power Pages exposure linked to 27m records
Researchers have linked a 27-million-record data exposure to publicly readable Microsoft Power Pages and Dataverse configurations rather than a confirmed zero-day.
-
Alation investigates unauthorised access
Enterprise data platform Alation is investigating unauthorised activity in one of its systems, with the extent of any customer or data impact still unknown.