Good morning, ONSEC Cyber Daily readers! Today, we're diving into a whirlwind of cybersecurity alerts and vulnerabilities that have been making headlines. The CISA, FBI, NSA, and International Partners have released a joint advisory on the top routinely exploited vulnerabilities of 2023. This comes as Germany's cybersecurity is on high alert ahead of elections, pointing to the country's vulnerability to hybrid threats, including hacking. In the automotive world, Mazda's Connect System is under scrutiny as cybersecurity experts warn of its vulnerability to hackers. Meanwhile, Apple users in India have been issued a high-severity alert due to a vulnerability that could lead to a cyber attack. Google Chrome users are also at risk, with CERT-In advising an urgent update to fix security flaws that could allow cybercriminals to execute arbitrary code, compromise sensitive data, or cause system crashes. In other news, a critical vulnerability in the WPLMS WordPress Theme puts websites at risk of RCE attacks, and the Government of India has issued a 'high' severity alert for Apple users. We also have updates on the latest patches for high severity vulnerabilities in SAP, HPE, and Dell Enterprise systems. However, D-Link has decided not to fix a critical bug found in its end-of-life NAS devices. Finally, we have a roundup of the latest cybersecurity podcasts, including discussions on data privacy, the evolution of hybrid work, and the latest in automotive tech. Stay tuned for more updates and remember, stay safe in the cyber world!

Exploits Alert

1. CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities: The advisory highlights the most exploited vulnerabilities by cybercriminals in 2023, providing a comprehensive guide for organizations to prioritize their defensive measures. Source: us-cert.cisa.gov.
2. Germany's Cybersecurity on High Alert Ahead of Elections: The Federal Office for Information Security's annual report points to Germany's vulnerability to hybrid threats, including hacking, emphasizing the need for heightened cybersecurity measures. Source: dig.watch.
3. Cybersecurity Experts Warn Mazda's Connect System Is Vulnerable To Hackers: CyberInsider reports that Mazda's Connect system has security flaws that make it susceptible to hacking. The automaker has yet to release a patch for these vulnerabilities. Source: carscoops.com.
4. High Severity Alert Issued by GOI for Apple Users in India: The Government of India has issued a high-risk warning for Apple users due to a vulnerability that could lead to a cyber attack. Users are advised to update their software to mitigate risks. Source: techlusive.in.
5. PAN-OS Access Management RCE Vulnerability, 11k+ Interface IPs Exposed: Palo Alto published an advisory warning of a Remote Code Execution (RCE) vulnerability in PAN-OS Access Management, exposing over 11,000 interface IPs. Users are urged to secure their interfaces. Source: cybersecuritynews.com.

Vulnerabilities & Patches

1. SAP Security Update: Patch For High Severity Vulnerabilities: SAP has released a patch for a critical vulnerability, CVE-2024-39592, in its Product Design Cost Estimating (PDCE) tool. The vulnerability, which has a CVSS score of 7.7, could allow an attacker to exploit the system. Source: cybersecuritynews.com
2. HPE Security Patches CVE-2024-42509 in Aruba Access Points: HPE has issued critical patches for CVE-2024-42509 to address remote code execution risks in Aruba Access Points. Users are advised to apply the patches immediately to prevent potential attacks. Source: thecyberexpress.com
3. Dell Enterprise SONiC Vulnerabilities Let Attackers Compromise The System: Dell has identified a high-risk vulnerability, CVE-2024-45763, in its Enterprise SONiC system. The OS Command Injection flaw, with a CVSS score of 9.1, could allow a high-privileged attacker to compromise the system remotely. Source: cybersecuritynews.com
4. Veeam Backup Enterprise Manager: Unauthorized access by attackers possible: A critical vulnerability, CVE-2024-40711, has been identified in Veeam Backup Enterprise Manager. A security patch is now available to close this vulnerability and prevent unauthorized access by attackers. Source: heise.de
5. D-Link To Not Fix Critical Bug Found In End-of-Life NAS Devices: D-Link has announced that it will not provide patches or support for a critical bug, CVE-2024-10914, found in its end-of-life NAS devices. Users are left without an official patch, highlighting the importance of updating to supported devices. Source: thecyberexpress.com

Podcasts

1. Hacking Podcast Amit Dubey - YouTube: This is the 6th episode of the Hacking Podcast series by Amit Dubey, where he discusses how to stay cyber secure and protect yourself from emerging threats. Source: YouTube
2. Wait, We Can Prioritize Data Privacy Before an Incident? (LIVE at Stanford) - CISO Series: This episode of the CISO Series Podcast, recorded live at Stanford, discusses the importance of prioritizing data privacy before a security incident occurs. Source: CISO Series
3. 3085: NTT Data - AI, Cybersecurity, and the Evolution of Hybrid Work - The Tech Talks Daily Podcast: Tanvir Khan, Executive Vice President at NTT Data, joins this episode of Tech Talks Daily to discuss AI, cybersecurity, and the evolution of hybrid work. Source: iHeart
4. 675 hp AUDI E, Cybercab hits the road, and BYD gets set to take down Ford - Electrek: This episode of the Electrek podcast discusses the 675 hp AUDI E concept, the launch of a self-driving Tesla in Texas, and BYD's plans to compete with Ford. Source: Electrek
5. From Cryptocurrency Crackdowns to Healthcare Cybersecurity Readiness - HEAL Security: This episode of the HEAL Security podcast discusses recent cryptocurrency crackdowns and the state of cybersecurity readiness in the healthcare sector. Source: iVoox

Wisdom from the ONSEC Founders' Vault

Why is security important for MedTech? This article highlights the critical importance of cybersecurity in medical software, detailing the risks posed by vulnerabilities like CVE-2020-23829 and emphasizing the necessity of regular penetration testing and robust security measures to protect sensitive patient data and ensure patient safety. Source.

Final Words

And that's a wrap for today's edition of 'ONSEC Cyber Daily'. We've covered a lot of ground, from joint advisories by international security agencies to the latest vulnerabilities in popular tech products. Remember, staying informed is the first step in maintaining a robust defense against cyber threats. If you found this newsletter helpful, consider sharing it with your friends and colleagues. Let's work together to create a safer digital world. Stay safe, stay vigilant, and see you in the next edition of 'ONSEC Cyber Daily'.