Security News
![Zimbra auth bypass bug exploited to breach over 1,000 servers](/static/build/img/news/zimbra-auth-bypass-bug-exploited-to-breach-over-1000-servers-small.jpg)
An authentication bypass Zimbra security vulnerability is actively exploited to compromise Zimbra Collaboration Suite email servers worldwide. Zimbra is an email and collaboration platform used by more than 200,000 businesses from over 140 countries, including over 1,000 government and financial organizations.
![VMware warns of public exploit for critical auth bypass vulnerability](/static/build/img/news/vmware-warns-of-public-exploit-for-critical-auth-bypass-vulnerability-small.jpg)
Proof-of-concept exploit code is now publicly available online for a critical authentication bypass security flaw in multiple VMware products that enables attackers to gain admin privileges.A week ago, VMware released updates to address the vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation.
![VMWare Urges Users to Patch Critical Authentication Bypass Bug](/static/build/img/news/vmware-urges-users-to-patch-critical-authentication-bypass-bug-small.jpg)
VMware and experts alike are urging users to patch multiple products affected by a critical authentication bypass vulnerability that can allow an attacker to gain administrative access to a system as well as exploit other flaws. "Given the prevalence of attacks targeting VMware vulnerabilities and a forthcoming proof-of-concept, organizations need to make patching CVE-2022-31656 a priority," Claire Tillis, senior research engineer with Tenable's Security Response Team, said in an email to Threatpost.
![VMware patches critical 'make me admin' auth bypass bug, plus nine other flaws](/static/build/img/news/vmware-patches-critical-make-me-admin-auth-bypass-bug-plus-nine-other-flaws-small.jpg)
VMware has fixed a critical authentication bypass vulnerability that hits 9.8 out of 10 on the CVSS severity scale and is present in multiple products. The critical vulnerability is similar to, or perhaps even a variant or patch bypass of, an earlier critical authentication bypass vulnerability that also rated 9.8 in severity and VMware fixed back in May. Shortly after that update was issued, CISA demanded US government agencies pull the plug on affected VMware products if patches can't be applied.
![VMware urges admins to patch critical auth bypass bug immediately](/static/build/img/news/vmware-urges-admins-to-patch-critical-auth-bypass-bug-immediately-small.jpg)
VMware has warned admins today to patch a critical authentication bypass security flaw affecting local domain users in multiple products and enabling unauthenticated attackers to gain admin privileges. "This critical vulnerability should be patched or mitigated immediately per the instructions in VMSA," VMware warned.
![Phishers steal Office 365 users’ session cookies to bypass MFA, commit payment fraud](/static/build/img/news/phishers-steal-office-365-users-session-cookies-to-bypass-mfa-commit-payment-fraud-small.jpg)
A massive phishing campaign has been targeting Office 365 users in over 10,000 organizations since September 2021 and successfully bypassing multi-factor authentication set up to protect the accounts. The attackers use proxy servers and phishing websites to steal users' password and session cookie.
![A great day for non-robots: iOS 16 will bypass CAPTCHAs](/static/build/img/news/a-great-day-for-non-robots-ios-16-will-bypass-captchas-small.jpg)
Apple has introduced a game-changer into its upcoming iOS 16 for those who hate CAPTCHAs, in the form of a feature called Automatic Verification. The feature does exactly what its name alludes to: automatically verifies devices and Apple ID accounts without any action from the user.
![Critical Flaw in Cisco Secure Email and Web Manager Lets Attackers Bypass Authentication](/static/build/img/news/critical-flaw-in-cisco-secure-email-and-web-manager-lets-attackers-bypass-authentication-small.jpg)
Cisco on Wednesday rolled out fixes to address a critical security flaw affecting Email Security Appliance and Secure Email and Web Manager that could be exploited by an unauthenticated, remote attacker to sidestep authentication.Assigned the CVE identifier CVE-2022-20798, the bypass vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring system and stems from improper authentication checks when an affected device uses Lightweight Directory Access Protocol for external authentication.
![Cisco Secure Email bug can let attackers bypass authentication](/static/build/img/news/cisco-secure-email-bug-can-let-attackers-bypass-authentication-small.jpg)
Cisco notified customers this week to patch a critical vulnerability that could allow attackers to bypass authentication and login into the web management interface of Cisco email gateway appliances with non-default configurations. The security flaw was found in the external authentication functionality of virtual and hardware Cisco Email Security Appliance and Cisco Secure Email and Web Manager appliances.
![Cybercriminals use automated bot to bypass 2FA authentication at wide scale](/static/build/img/news/alt/managed-security-small.jpg)
Single factor authentication has been the standard for many years on Internet-facing services, but it clearly lacks security. While 2FA drastically increases the security of Internet services, it can still be bypassed by some methods.