Cybersecurity

CISA has published an advisory on a heap-based buffer overflow vulnerability in Fuji Electric V-Server Lite. All versions prior to 4.0.9.0 are affected. Successful exploitation of this vulnerability could allow a remote attacker to gain elevated privileges for remote code execution. Fuji Electric has released Version 4.0.9.0 to mitigate the reported vulnerability. CISA also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.

CISA has published an advisory on a cross-site scripting vulnerability in HMS Networks eWON Flexy and Cosy. For both products, all firmware versions prior to 14.1s0 are affected. Successful exploitation of this vulnerability could initiate a password change. HMS Networks recommends users update to latest firmware, Version 14.1s0. CISA also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.

CISA has published an advisory on unrestricted upload of file with dangerous type, SQL injection, relative path traversal, missing authentication for critical function, improper restriction of XML external entity reference, and OS command injection vulnerabilities in Advantech WebAccess/NMS. Versions prior to 3.0.2 are affected. Successful exploitation of these vulnerabilities may allow an attacker to gain remote code execution, upload files, delete files, cause a denial-of-service condition, and create an admin account for the application.

Recently, virtual conferencing platform Zoom has received the lion’s share of criticism among collaboration platforms, but recent research by global cybersecurity firm Kaspersky reminds us that Zoom is not the only one being abused. Kaspersky’s findings reveal that Skype is the number one virtual conference platform being impersonated through malicious downloads. Unsurprisingly, fake apps masquerading as Zoom come in second, followed by WebEx, GoToMeeting, Flock, and Slack.