VMware Alert: Uninstall EAP Now! Critical flaws endanger Active Directory.

Article Summary

TLDR:

VMware is urging users to uninstall the deprecated Enhanced Authentication Plugin (EAP) due to a critical security flaw.
The flaw, CVE-2024-22245, allows arbitrary authentication relay, putting Active Directory at risk.

VMware has discovered a critical security flaw in the deprecated Enhanced Authentication Plugin (EAP), tracked as CVE-2024-22245 with a CVSS score of 9.6. The vulnerability allows for arbitrary authentication relay, posing a risk to Active Directory. EAP, which has been deprecated since March 2021, is a software package used for direct login to vSphere’s management interfaces through a web browser. Additionally, a session hijack flaw (CVE-2024-22250, CVSS score: 7.8) was also found in the EAP tool. Users are advised to remove the plugin to mitigate potential threats. Alongside this, SonarSource disclosed cross-site scripting flaws in Joomla! and vulnerabilities in the Apex programming language developed by Salesforce. These vulnerabilities underline the importance of software security and timely updates.

Post Views: 99

Latest from Blog

Bogus job tempts aerospace, energy workers

TLDR: A North Korean cyberespionage group is posing as job recruiters to target employees in aerospace and energy sectors. Mandiant reports that the group uses fake job descriptions stored in malicious archives

Picus Security Secures $45M for Enhanced Exposure Management Solutions

TLDR: Picus Security has received a $45M investment from Riverwood Capital to enhance its exposure management platform. The investment will help Picus expand its capabilities in attack surface management, automated penetration testing,

Secure solar power with effective cybersecurity for renewable energy success

TLDR: Solar energy systems are vulnerable to outside attacks through inverters, microgrids, and DoS attacks. Cybersecurity professionals can protect solar energy by teaching security, updating software, and setting up a strong firewall.

Health sector cyberattacks Critics slam federal response as weak and disjointed

TLDR: Health care is the most frequent target for ransomware attacks. Federal response to cyberattacks in the health industry is criticized as feeble and fractured. Health care industry faced numerous cyberattacks, including

Beware: UNC2970 Hackers Weapons in Job Seekers’ PDFs

TLDR: UNC2970 hackers are targeting job seekers with weaponized PDF files. They use sophisticated phishing tactics to deliver malware to victims. In a recent report, cybersecurity analysts at Google Mandiant have identified

Cyber insurance changes shape of security for good and bad

TLDR: Key Points: Cyber-insurance landscape is shifting to encourage greater cyber resiliency Rising costs of cyberattacks are prompting insurers to re-examine underwriting How Cyber-Insurance Shifts Affect the Security Landscape The article discusses

VMware Alert: Uninstall EAP Now Critical flaws endanger Active Directory

TLDR:

Adrian Johnson

Latest from Blog

Bogus job tempts aerospace, energy workers

Picus Security Secures $45M for Enhanced Exposure Management Solutions

Secure solar power with effective cybersecurity for renewable energy success

Health sector cyberattacks Critics slam federal response as weak and disjointed

Beware: UNC2970 Hackers Weapons in Job Seekers’ PDFs

Cyber insurance changes shape of security for good and bad

CMS warns nearly 1 million Medicare members of 2023 MOVEit breach

BMW i invests in cybersecurity firm safeguarding software seamlessly

Chinese U Competition Hacks Real Victim: A Targeted University?

GSMA to Implement Full Encryption for RCS Messaging Platforms

Suggestions

VMware Alert: Uninstall EAP Now Critical flaws endanger Active Directory

TLDR:

Latest from Blog