It was discovered that polkit incorrectly handled nested elements in XML
policy files. If an administrator were tricked into installing a malicious
policy file, a remote attacker could possibly use this issue to cause
polkit to crash, resulting in a denial of service. (CVE-2025-7519)
Pavel Kohout d...
Un ticket de réinitialisation de mot de passe a un coût pour l'entreprise et une interruption de travail pour l'utilisateur. Voici comment résoudre ce problème.
Le post Active Directory : comment éliminer les tickets de réinitialisation de mot de passe ? a été publié sur IT-Connect.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)Â added Apple, Laravel Livewire and Craft CMS flaws...
Fake Claude website impersonates Anthropic and delivers PlugX RAT via ZIP download using DLL sideloading. A fake website impersonating Anthropic’s Claude service was found distributing the PlugX remote access trojan, according to Malwarebytes. The rogue site abuses the chatbot’s popularity to trick...
Linus Torvalds a officialisé la sortie du noyau Linux 7.0 ! Quelles sont les nouveautés ? S'agit-il d'une version majeure ? Voici l'essentiel à savoir.
Le post Le noyau Linux 7.0 est là : voici les nouveautés principales ! a été publié sur IT-Connect.
Deutschland ist im Visier staatlicher Hacker.Mdisk – shutterstock.com
Hybride Attacken auf kritische Infrastruktur in Deutschland und Bundeswehr-Truppen im Ausland nehmen weiter zu. Spätestens seit 2022 sei ein spürbarer Zuwachs zu verzeichnen, sagte der Bundeswehr-Inspekteu...
CVSSv3 Score:
6.2
A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, t...
This post is part of a small blog series covering common Entra ID security findings observed during real-world assessments. Each article explores selected findings in more detail to provide a clearer understanding of the underlying risks and practical implications. Conditional Access Policies Condit...
CVSSv3 Score:
6.7
An Improper authentication vulnerability [CWE-287] in FortiSOAR web GUI may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to...
CVSSv3 Score:
6.2
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS and FortiSandbox Cloud WEB UI may allow a privileged attacker with super-admin profile and CLI access to delete...
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSiteI'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tic...
CVSSv3 Score:
4.1
A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration.
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
4.1
A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
Revised on 2026-04-14 00:...
The cybersecurity landscape is undergoing a fundamental transformation. Over the past few years, organizations have witnessed a sharp increase in reported vulnerabilities, with global disclosures crossing 20,000+ annually. While this surge may appear alarming, it does not necessarily indicate that s...
CVSSv3 Score:
6.2
A Cleartext Transmission of Sensitive Information vulnerability [CWE-319] in FortiSOAR may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
2.5
An Insufficiently protected credentials vulnerability [CWE-522] in FortiSanbox and FortiSanbox PaaS GUI may allow an authenticated administrator to read LDAP server credentials via client-side inspection.
Revised on 2026-04-14 00:00:00
Several security issues were fixed in Redis, lua5.1, lua-cjson, lua-bitop.
CVSSv3 Score:
5.2
A use of hard-coded cryptographic key vulnerability [CWE 321] in FortiClientEMS may allow an attacker in possession of an encrypted dump of the database to decrypt it.
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
7.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiAnalyzer Cloud oftpd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large amount of effort in...
In this Help Net Security interview, Idan Habler, AI Security Researcher at Cisco, breaks down a threat most security teams haven’t named yet: agentic memory as an attack surface. Habler walks through MemoryTrap, a disclosed and remediated method to compromise Claude Code’s memory, showing how a sin...