Aggregator

Firm Failed to Close Outdated User Account, Waited 43 Days to Notify Regulators
The U.K. Information Commissioner's Office imposed a fine of 60,000 pounds against Liverpool-based law firm DDP Law for GDPR violations relating to a 2022 ransomware hack and data leak that exposed sensitive information including the details of its clients' cases.

Name: 2025 Embedded Capture the Flag (an MITRE eCTF event.)
Date: Jan. 15, 2025, 5 p.m. — 16 April 2025, 16:00 UTC  [add to calendar]
Format: Attack-Defense
On-line
Offical URL: https://ectf.mitre.org/
Rating weight: 0
Event organizers: ectfmitre

Changes aim to tighten integration with the National Institute of Standards and Technology's Cybersecurity Framework and help organizations develop a stronger posture to handle privacy risks.

A vulnerability, which was classified as critical, was found in Apple watchOS. Affected is an unknown function of the component Web Content Handler. The manipulation leads to improper restriction of rendered ui layers. This vulnerability is traded as CVE-2024-23284. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Apple visionOS and classified as critical. Affected by this vulnerability is an unknown functionality of the component Image Handler. The manipulation leads to buffer overflow. This vulnerability is known as CVE-2024-23286. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple tvOS and classified as critical. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation leads to buffer overflow. This vulnerability is handled as CVE-2024-23286. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple iOS and iPadOS. It has been classified as critical. This affects an unknown part of the component Image Handler. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2024-23286. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple macOS. It has been declared as critical. This vulnerability affects unknown code of the component Image Handler. The manipulation leads to buffer overflow. This vulnerability was named CVE-2024-23286. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple watchOS. It has been rated as critical. This issue affects some unknown processing of the component Image Handler. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2024-23286. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Apple tvOS. Affected by this issue is some unknown functionality of the component Webpage Handler. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2024-23280. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

The Cybersecurity and Infrastructure Security Agency (CISA) has extended funding to the MITRE Corporation, ensuring the continued operation of the Common Vulnerabilities and Exposures (CVE) program, a linchpin of global cybersecurity. Announced late on April 15, 2025, just hours before the program’s funding was set to expire, the 11-month extension averts a crisis that could […]

The post CISA Extend Funding to MITRE to Keep CVE Program Running appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Concerns about the future of the MITRE CVE Program continue to circulate. The Tenable Security Response Team has created this FAQ to help provide clarity and context around this developing situation.

Background

The Tenable Security Response Team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding changes around the MITRE CVE Program. As the situation continues to evolve, we will continue to provide updates as new information is released.

FAQ

What is the current status of the MITRE CVE Program?

As of April 16, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has extended funding for the MITRE CVE Program for one year. In a post and update to their website, CISA confirmed the extension, and a spokesperson added that they “executed the option period on the contract to ensure there will be no lapse in critical CVE services.”

pic.twitter.com/DYv4uKzLrq

— Cybersecurity and Infrastructure Security Agency (@CISAgov) April 16, 2025

When did CVE Board Members find out about the expiration of the MITRE CVE Program and other related programs?

CVE Board members received a notification from MITRE on April 15, 2025. This notification was circulated on social media and picked up in news articles. Tenable published a blog post about the forthcoming expiration and updated it on April 16 upon news of the subsequent renewal.

What is the importance of the CVE Program?

The CVE Program provides the industry with a common identifier used for identifying vulnerabilities which in turn allows the industry to fully track all affected products, remediations, tactics, techniques and procedures (TTPs) and risk measurements for a vulnerability. Without this we run the risk of being unable to accurately map active exploitation and associated risk to that vulnerability.

One important function that the CVE program serves is to operate as a CVE Naming Authority (CNA) of last resort, particularly when there are disputes over CVE issuance. This helps to minimize conflicting reports and duplicate records.

What is the value of having a CVE Naming Authority (CNA)?

The CVE Program enables various entities to become a CNA. The CNA program allows vendors, researchers, open source developers and others to reserve and assign CVEs while providing information about a vulnerability. Currently there are over 450 CNAs that participate in the CVE Program.

What is Tenable’s relationship with the CVE Program?

Tenable is a CNA within the CVE Program and, as such, issues CVEs for its own products and vulnerabilities in other products discovered by its research team for which there is no CNA.

What about the announcements of efforts from the CVE Foundation and GCVE?

On the morning of April 16, 2025, the CVE Foundation published a press release regarding an effort for transitioning the CVE program to a non-profit foundation established by active CVE Board members. The CVE Foundation aims to move the CVE Program away from a government-funded project to eliminate the risk of “a single point of failure in the vulnerability management ecosystem.”

Additionally, we are aware of other efforts being launched, including the Global CVE (GCVE) allocation system by the Computer Incident Response Center Luxembourg (CIRCL). According to their FAQ, GCVE is a “decentralized system for identifying and numbering security vulnerabilities.” The GCVE site notes that existing CNAs can become GCVE Numbering Authorities (GNAs) and would have autonomy to define their own policies for the identification of vulnerabilities.

Tenable will continue to monitor these evolving efforts surrounding CVE and other programs and update the community as we learn more.

How is Tenable impacted by the interruptions to CVE issuance at both MITRE and the National Vulnerability Database (NVD)?

With uncertainty around interruptions to the CVE Program, Tenable has reserved a sufficient number of CVEs for disclosing vulnerabilities in our products and those discovered in other products.

Tenable is not dependent on either MITRE or NVD for sourcing the logic needed to determine if a product is vulnerable or not. We source our coverage from vendor advisories, which will enable us to continue providing coverage as long as vendors publish security advisories.

Get more information

• Tenable Blog: MITRE CVE Program Funding Extended For One Year
• Tenable Blog: Recent NVD Delays Won’t Affect Tenable Vulnerability Management Customers Thanks To Our Diverse Scoring Sources
• CVE Foundation
• Global CVE Allocation System (GCVE)

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post Frequently Asked Questions About the MITRE CVE Program Expiration and Renewal appeared first on Security Boulevard.

Concerns about the future of the MITRE CVE Program continue to circulate. The Tenable Security Response Team has created this FAQ to help provide clarity and context around this developing situation.

Background

The Tenable Security Response Team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding changes around the MITRE CVE Program. As the situation continues to evolve, we will continue to provide updates as new information is released.

FAQ

What is the current status of the MITRE CVE Program?

As of April 16, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has extended funding for the MITRE CVE Program for one year. In a post and update to their website, CISA confirmed the extension, and a spokesperson added that they “executed the option period on the contract to ensure there will be no lapse in critical CVE services.”

pic.twitter.com/DYv4uKzLrq

— Cybersecurity and Infrastructure Security Agency (@CISAgov) April 16, 2025

When did CVE Board Members find out about the expiration of the MITRE CVE Program and other related programs?

CVE Board members received a notification from MITRE on April 15, 2025. This notification was circulated on social media and picked up in news articles. Tenable published a blog post about the forthcoming expiration and updated it on April 16 upon news of the subsequent renewal.

What is the importance of the CVE Program?

The CVE Program provides the industry with a common identifier used for identifying vulnerabilities which in turn allows the industry to fully track all affected products, remediations, tactics, techniques and procedures (TTPs) and risk measurements for a vulnerability. Without this we run the risk of being unable to accurately map active exploitation and associated risk to that vulnerability.

One important function that the CVE program serves is to operate as a CVE Naming Authority (CNA) of last resort, particularly when there are disputes over CVE issuance. This helps to minimize conflicting reports and duplicate records.

What is the value of having a CVE Naming Authority (CNA)?

The CVE Program enables various entities to become a CNA. The CNA program allows vendors, researchers, open source developers and others to reserve and assign CVEs while providing information about a vulnerability. Currently there are over 450 CNAs that participate in the CVE Program.

What is Tenable’s relationship with the CVE Program?

Tenable is a CNA within the CVE Program and, as such, issues CVEs for its own products and vulnerabilities in other products discovered by its research team for which there is no CNA.

What about the announcements of efforts from the CVE Foundation and GCVE?

On the morning of April 16, 2025, the CVE Foundation published a press release regarding an effort for transitioning the CVE program to a non-profit foundation established by active CVE Board members. The CVE Foundation aims to move the CVE Program away from a government-funded project to eliminate the risk of “a single point of failure in the vulnerability management ecosystem.”

Additionally, we are aware of other efforts being launched, including the Global CVE (GCVE) allocation system by the Computer Incident Response Center Luxembourg (CIRCL). According to their FAQ, GCVE is a “decentralized system for identifying and numbering security vulnerabilities.” The GCVE site notes that existing CNAs can become GCVE Numbering Authorities (GNAs) and would have autonomy to define their own policies for the identification of vulnerabilities.

Tenable will continue to monitor these evolving efforts surrounding CVE and other programs and update the community as we learn more.

How is Tenable impacted by the interruptions to CVE issuance at both MITRE and the National Vulnerability Database (NVD)?

With uncertainty around interruptions to the CVE Program, Tenable has reserved a sufficient number of CVEs for disclosing vulnerabilities in our products and those discovered in other products.

Tenable is not dependent on either MITRE or NVD for sourcing the logic needed to determine if a product is vulnerable or not. We source our coverage from vendor advisories, which will enable us to continue providing coverage as long as vendors publish security advisories.

Get more information

• Tenable Blog: MITRE CVE Program Funding Extended For One Year
• Tenable Blog: Recent NVD Delays Won’t Affect Tenable Vulnerability Management Customers Thanks To Our Diverse Scoring Sources
• CVE Foundation
• Global CVE Allocation System (GCVE)

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

A vulnerability, which was classified as problematic, was found in Apple iOS and iPadOS. This affects an unknown part of the component Webpage Handler. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-23280. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Apple Safari and classified as problematic. This vulnerability affects unknown code of the component Webpage Handler. The manipulation leads to information disclosure. This vulnerability was named CVE-2024-23280. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple macOS and classified as problematic. This issue affects some unknown processing of the component Webpage Handler. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2024-23280. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple watchOS. It has been classified as problematic. Affected is an unknown function of the component Webpage Handler. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2024-23280. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Premium Addons Pro Plugin up to 2.9.12 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Custom Mouse Cursor Module. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-2238. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Premium Addons Pro Plugin up to 2.9.12 on WordPress and classified as problematic. Affected by this issue is some unknown functionality of the component Premium Magic Scroll Module. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-2239. The attack may be launched remotely. There is no exploit available.

New vulnerabilities in Windows Task Scheduler’s schtasks.exe let attackers bypass UAC, alter metadata, modify event logs, and evade detection. These actions map to MITRE ATT&CK tactics: Persistence, Privilege Escalation, Execution, Lateral Movement, and Defense Evasion. Abuse of schtasks.exe enables stealthy task creation and manipulation without alerting defenders, making it a reliable tool for maintaining access […]

The post Windows Task Scheduler Vulnerabilities Allow Attackers Gain Admin Account Control appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.