Security Affairs
Hack One Robot, Reach the Next: Unitree G1 Security Flaws|Rhysida Ransomware Group Targets Berlin Government Ahead of Vote|Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator|Love Electric Breach: 877,000 Driver Records Offered for $600|Trump Targets Foreign Technology in New U.S. Power Grid Security Order|U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog|Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations|PaperCut Zero-Day Under Active Attack: Emergency Patch Released|U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog|Cyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three Airports|Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Hack One Robot, Reach the Next: Unitree G1 Security Flaws|Rhysida Ransomware Group Targets Berlin Government Ahead of Vote|Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator|Love Electric Breach: 877,000 Driver Records Offered for $600|Trump Targets Foreign Technology in New U.S. Power Grid Security Order|U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog|Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations|PaperCut Zero-Day Under Active Attack: Emergency Patch Released|U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog|Cyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three Airports|Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|
Advertisement

Ad Placeholder

Full Width × 90

Breaking News

Progress Software fixed 2 new critical flaws in WhatsUp Gold

Progress Software addresses six new security vulnerabilities affecting its WhatsUp Gold, two of them are rated as critical severity. Progress Software has addressed six new security vulnerabilities in its IT infrastructure monitoring product WhatsUp Gold. “The WhatsUp Gold team has identified six vulnerabilities that exist in versions below 24.0.1. We are reaching out to all […]

Progress LoadMaster

Progress Software addresses six new security vulnerabilities affecting its WhatsUp Gold, two of them are rated as critical severity.

Progress Software has addressed six new security vulnerabilities in its IT infrastructure monitoring product WhatsUp Gold.

“The WhatsUp Gold team has identified six vulnerabilities that exist in versions below 24.0.1. We are reaching out to all WhatsUp Gold customers to upgrade their environment as soon as possible to version 24.0.1, released on Friday, September 20.” reads the advisory. “If you are running a version older than 24.0.1 and you do not upgrade, your environment will remain vulnerable. Please take the following steps as soon as possible: 

  1. Download the WhatsUp Gold 24.0.1 installer from https://community.progress.com/s/products-list
  2. Run the installer on your WhatsUp Gold server and follow the prompts. “

Two of the vulnerabilities fixed by Progress, respectively tracked as CVE-2024-8785 and CVE-2024-46909, are rated as critical severity.

CVE-2024-8785 (CVSS score of 9.8) was reported by Trend Micro researchers Andy Niu, while CVE-2024-46909 (CVSS score of 9.8) was reported by Tenable.

Below are the other vulnerabilities addressed by the company:

  • CVE-2024-46905 (CVSS score: 8.8)
  • CVE-2024-46906 (CVSS score: 8.8)
  • CVE-2024-46907 (CVSS score: 8.8)
  • CVE-2024-46908 (CVSS score: 8.8)

The company addressed the issues with version 24.0.1 released on September 20, 2024. The company has yet to disclose technical details about the vulnerabilities, it’s unclear if the are actively exploited in attacks in the wild.

In mid-September, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress WhatsUp Gold SQL Injection vulnerability, tracked as CVE-2024-6670, to its Known Exploited Vulnerabilities catalog. An unauthenticated attacker could trigger this vulnerability to retrieve the users’ encrypted password. The flaw impacts WhatsUp Gold versions released before 2024.0.0.

    WhatsUp Gold Customers are recommended to address the above vulnerabilities as soon as possible.

    Follow me on Twitter: @securityaffairs and Facebook and Mastodon

    Pierluigi Paganini

    (SecurityAffairs – hacking, Progress Software)

    Tags

    Hackinghacking newsinformation security newsIT Information SecurityPierluigi PaganiniProgress SoftwareSecurity AffairsSecurity News

    More Stories>

    Hack One Robot, Reach the Next: Unitree G1 Security FlawsBreaking News

    Hack One Robot, Reach the Next: Unitree G1 Security Flaws

    Rhysida Ransomware Group Targets Berlin Government Ahead of VoteBreaking News

    Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

    Philippine Nuclear and Naval Targets Hit by Suspected Chinese OperatorAPT

    Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

    Security>

    Hacking>

    Malware>