The WordPress WP HTML Mail plugin for personalized emails is vulnerable to code injection and phishing due to XSS.

https://threatpost.com/wordpress-insecure-plugin-rest-api/177866/

McAfee has patched two high-severity bugs in its Agent component, one of which can allow attackers to achieve arbitrary code execution with SYSTEM privileges.

https://threatpost.com/mcafee-bug-windows-system-privileges/177857/

Cisco issued a critical fix for a flaw in its Cisco RCM for Cisco StarOS Software that could give attackers RCE on the application with root-level privileges.

https://threatpost.com/critical-cisco-staros-bug-root-access-debug-mode/177832/

SolarWinds has fixed a Serv-U bug that threat actors were exploiting to unleash Log4j attacks on networks’ internal devices.

https://threatpost.com/microsoft-log4j-attackssolarwinds-serv-u-bug/177824/

The information-disclosure issue, affecting Macs, iPhones and iPads, allows a snooping website to find out information about other tabs a user might have open.

https://threatpost.com/apple-safari-bug-browsing-data-google-ids/177809/

A security bug in the file-sharing cloud app could have allowed attackers using stolen credentials to skate by one-time SMS code verification requirements.

https://threatpost.com/box-2fa-bypass-accounts-attack/177760/

Attackers can access audio and files uploaded to the MY2022 mobile app required for use by all winter games attendees – including personal health details.

https://threatpost.com/beijing-olympics-app-flaws-allow-man-in-the-middle-attacks/177748/

Praise be & pass the recipe for the software soup: There’s too much scrambling to untangle vulnerabilities and dependencies, say a security experts roundtable.

https://threatpost.com/2022-software-bill-of-materials/177736/

It’s time to sound the alarm for Log4Shell. Saryu Nayyar, CEO at Gurucul, discusses what actions you should be taking.

https://threatpost.com/log4j-vulnerability-pressures-security-world/177721/

Zoho’s comprehensive endpoint-management platform suffers from an authentication-bypass bug (CVE-2021-44757) that could lead to remote code execution.

https://threatpost.com/critical-manageengine-desktop-server-bug-malware/177705/

Companies must take more ‘innovative and proactive’ approaches to security in 2022 to combat threats that emerged last year, researchers said.

https://threatpost.com/organizations-losing-battle-vulnerabilities/177696/

Phishing is more successful than ever. Daniel Spicer, CSO of Ivanti, discusses emerging trends in phishing, and using zero-trust security to patch the human vulnerabilities underpinning the spike.

https://threatpost.com/mobile-phishing-zero-trust-security/177594/

Attackers could access and modify agent resources, telephone queues and other customer-service systems – and access personal information on companies’ customers.

https://threatpost.com/critical-cisco-contact-center-bug/177681/

Researchers discovered vulnerabilities that can allow for full site takeover in login and e-commerce add-ons for the popular website-building platform.

https://threatpost.com/plugins-vulnerability-84k-wordpress-sites/177654/

Since their release on Patch Tuesday, the updates have been breaking Windows, causing spontaneous boot loops on Windows domain controller servers, breaking Hyper-V and making ReFS volume systems unavailable.

https://threatpost.com/microsoft-yanks-buggy-windows-server-updates/177648/

US Cyber Command linked the group to Iranian intelligence and detailed its multi-pronged, increasingly sophisticated suite of malware tools.

https://threatpost.com/us-military-ties-muddywater-cyberespionage-apt-iran/177633/

GootLoader hijacks WordPress sites to lure professionals to download malicious sample contract templates.

https://threatpost.com/gootloader-accounting-law-firms/177629/

Most Windows versions are at risk of remote, unprivileged attackers abusing RDP from the inside to hijack smart cards and get unauthorized file system access.

https://threatpost.com/windows-bug-rdp-exploit-unprivileged-users/177599/

It’s not about buying security products! Joseph Carson, chief security scientist from ThycoticCentrify, offers practical steps to start the zero-trust journey.

https://threatpost.com/zero-trust-future-security-risks/177502/

The large January 2022 Patch Tuesday update covers nine critical CVEs, including a self-propagator with a 9.8 CVSS score.

https://threatpost.com/microsoft-wormable-critical-rce-bug-zero-day/177564/