Buffclue

Recently, critical vulnerabilities were discovered in Zoom’s software, affecting users on various platforms, including Windows, macOS, Linux, iOS, and Android. These security flaws could allow hackers to gain unauthorized control over your device by escalating privileges, meaning they could access areas of your system they shouldn’t. What Happened? – Vulnerabilities like CVE-2024-39825 and CVE-2024-42441 were […]

Billionaire entrepreneur Elon Musk revealed that a cyberattack on his social media platform, X (formerly Twitter), disrupted his planned conversation with former President Donald Trump. Musk stated that he was working to shut down the “massive DDOS attack” that impacted X during the event. What’s Next? Despite the attack, the interview proceeded with a smaller

Cybersecurity researchers have discovered critical vulnerabilities in the Ewon Cosy+, a popular industrial remote access gateway tool, enabling them to gain root access and breach the device’s security. These alarming findings, revealed at DEF CON 32, expose significant threats to industrial infrastructure and remote access systems. The Ewon Cosy+, developed by HMS Networks, is intended

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about cyber threat actors exploiting the legacy Cisco Smart Install (SMI) feature to gain unauthorized access to sensitive data. CISA reports that attackers are leveraging this outdated Cisco feature to acquire system configuration files through available protocols or software on affected devices. Additionally,

The Indian Computer Emergency Response Team (CERT-IN) released an advisory highlighting ‘High’ severity vulnerabilities in Apple software products, including iPhone, iPad, Mac, and Apple Watch. Apple users with devices like the Vision Pro headset, iPhone, iPad, Mac, Apple Watch, or those using the Safari browser or streaming services should verify their software/OS versions to ensure

In a significant data breach incident, HealthEquity, a leading provider of health savings accounts (HSAs), experienced a cyberattack that compromised the sensitive information of over 4.3 million individuals. The breach, which came to light in July 2024, occurred through a compromised third-party vendor’s user accounts. Hackers were able to access a trove of personal data,

What is Multi-Factor Authentication? Multi-factor authentication (MFA) is a security process that requires users to provide two or more forms of identification before they can access an account or system. It adds an extra layer of protection beyond just a username and password, making it significantly more difficult for unauthorized users to gain access. Typically,

At Buffclue Security, we’ve observed malicious activities, as reported by eSentire and Proofpoint, involving the misuse of TryCloudflare for establishing one-time tunnels. These tunnels facilitate the transfer of traffic from an attacker’s server to a local machine through Cloudflare’s infrastructure. This technique has been utilized in distributing various malware families such as AsyncRAT, GuLoader, PureLogs

Overview of Incident Microsoft recently experienced a nearly 10-hour Azure outage triggered by a Distributed Denial of Service (DDoS) attack. However, a configuration error in their DDoS defenses unexpectedly amplified the impact of the attack. This complication highlights the intricate challenges involved in managing cloud security and underscores the importance of robust cloud infrastructure. Impact

In recent findings, Salt Labs uncovered a critical vulnerability affecting millions of websites due to a flawed implementation of the OAuth protocol. This vulnerability, primarily exposed in services like HotJar, Business Insider, and others highlights a potent risk where Cross-Site Scripting (XSS) and OAuth can be combined to compromise user accounts. OAuth, a widely-used authorisation