CVE-2024-2389

Progress Software Flowmon
02 Apr 2024
Published
02 Apr 2024
Updated
CVSS v3.1
CRITICAL (10.0)
  • 2 Posts
  • 4 Interactions

CVE Info

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.
MITRE
NVD

Fediverse

Profile picture
Glenn 📎@ntkramer

🥪 & : we published a tag for CVE-2024-2389, a command-injection vulnerability in Progress Flowmon accessible without authentication.

(fixed CVE # from a previous post)

viz.greynoise.io/tags/progress

  • 2
  • 2
  • 9 hours ago
Profile picture
Dark Web Informer@DarkWebInformer

🚨EXPLOIT CODE🚨PoC for critical Progress Flowmon vulnerability released (CVE-2024-2389).

github.com/RhinoSecurityLabs/C

X Link: twitter.com/DarkWebInformer/st

  • 0
  • 0
  • 18 hours ago

CVE-2024-3400

KEV
Palo Alto Networks PAN-OS
12 Apr 2024
Published
19 Apr 2024
Updated
CVSS v3.1
CRITICAL (10.0)
  • 2 Posts
  • 3 Interactions

CVE Info

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

Palto Alto Networks: How to Remedy CVE-2024-3400
So Palo Alto Networks has an actual remediation (read: incident response) knowledge base article for CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 as an exploited zero-day), "based on the current view of the most effective and least disruptive remediation for customers." Their guidance is simple:

  • Level 0 Probe: Unsuccessful exploitation attempt: No indication of compromise = apply hotfix patch
  • Level 1 Test: 0-byte file has been created and is resident on the firewall: still not compromised = apply hotfix patch
  • Level 2 Potential Exfiltration: File on the device has been copied to a location accessible via a web request (common IOC: running_config.xml): apply hotfix patch and perform private data reset (NOTE: PAN states suggested remediation will eliminate the possibility of capturing forensic artifacts)
  • Level 3 Interactive access: Interactive command execution: apply hotfix patch and factory reset.

It's implied that the threat actor would move laterally from the compromised device and establish persistence (additional backdoors, etc.) so threat hunting and containment should be prioritized.

  • 0
  • 1
  • 15 hours ago
Profile picture
Caitlin Condon@catc0n

Good haul this week, including modules for PAN-OS CVE-2024-3400, FortiClient CVE-2023-48788, and Apache Solr CVE-2023-50386. Some solid fixes and enhancements too! 🐚 rapid7.com/blog/post/2024/04/2

  • 0
  • 2
  • 10 hours ago

CVE-2024-4040

KEV
CrushFTP
22 Apr 2024
Published
23 Apr 2024
Updated
CVSS v3.1
CRITICAL (9.8)
  • 1 Post
  • 7 Interactions

CVE Info

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
MITRE
NVD

Fediverse

Profile picture
John Hammond@JohnHammond

The CrushFTP vulnerability, CVE-2024-4040 -- demo of the file inclusion trick and some of the speculation on the sessions.obj usage to gain remote code execution (I recorded this mid-week before some of the other public analysis was out 😅)
youtube.com/watch?v=etHDJWYEls

Big thanks to @FlareSystems for sponsoring this video! You can track down shady sellers, hunt for cybercrime, or manage threat intelligence and your exposed attack surface with Flare! Try a free trial: jh.live/flare

  • 4
  • 3
  • 17 hours ago

CVE-2024-20353

KEV
Cisco Adaptive Security Appliance (ASA) Software
24 Apr 2024
Published
24 Apr 2024
Updated
CVSS v3.1
HIGH (8.6)
  • 1 Post
  • 8 Interactions

CVE Info

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

  • 1
  • 7
  • 11 hours ago

CVE-2024-3094

Pending
29 Mar 2024
Published
18 Apr 2024
Updated
CVSS v3.1
CRITICAL (10.0)
  • 1 Post
  • 2 Interactions

CVE Info

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

Sysdig: Meet the Research behind our Threat Research Team – RSA 2024
I thought the title was a typo but Sysdig showcases various threats and vulnerabilities that their threat research team worked on: such as SSH-Snake, Romanian threat actor RUBYCARP, Operation SCARLETEEL, cryptojacking Operation AMBERSQUID, Meson Network, Operation LABRAT, CVE-2024-3094 (XZ Utils), and the Leaky Vessels vulnerabilities. You can meet the threat research team at booth S-742 at RSA Conference 2024, May 6 – 9 in San Francisco.

  • 1
  • 1
  • 16 hours ago

CVE-2022-38028

KEV
Microsoft Windows 10 Version 1809
11 Oct 2022
Published
20 Dec 2023
Updated
CVSS v3.1
HIGH (7.8)
  • 1 Post
  • 1 Interaction

CVE Info

Windows Print Spooler Elevation of Privilege Vulnerability
MITRE
NVD

Fediverse

Profile picture
Andro Abhi@andro_abhi

Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtai [...]

https://t.me/UnitooNews/31630

#UnitooDailyNews #unitoo #News #Worldnews #tech

  • 1
  • 0
  • 19 hours ago

CVE-2024-26218

Microsoft Windows 10 Version 1809
09 Apr 2024
Published
19 Apr 2024
Updated
CVSS v3.1
HIGH (7.8)
  • 1 Post
  • 1 Interaction

CVE Info

Windows Kernel Elevation of Privilege Vulnerability
MITRE
NVD

Fediverse

Profile picture
gabe_k@gabe_k

also if anyone wants to exploit CVE-2024-26218 i would be very interested in seeing that :)

  • 0
  • 1
  • 14 hours ago

CVE-2006-4304

Pending
24 Aug 2006
Published
19 Jul 2017
Updated
CVSS
Pending
  • 1 Post

CVE Info

Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp. NOTE: this issue was originally incorrectly reported for the ppp driver.
MITRE
NVD

Fediverse

Profile picture
:mastodon: decio@decio

Tiens, le pwnage de la PlayStation, discuté depuis le début de l'année, repose sur une faille de sécurité datant de 2006!

"For some reason, the PS4/PS5 is vulnerable to CVE-2006-4304. By having invalid options, it is possible to cause a heap buffer overwrite and overread."
👇
hackerone.com/reports/2177925

"PS4/PS5: TheFloW discloses Kernel vulnerability relying on old bug from 2006, impacts PS4 up to 11.00 & PS5 up to 8.20, more details in May"
👇
wololo.net/2024/04/26/ps4-ps5-

  • 0
  • 0
  • 20 hours ago

CVE-2023-50386

Apache Software Foundation Solr
09 Feb 2024
Published
09 Feb 2024
Updated
CVSS
Pending
  • 1 Post
  • 2 Interactions

CVE Info

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.
MITRE
NVD

Fediverse

Profile picture
Caitlin Condon@catc0n

Good haul this week, including modules for PAN-OS CVE-2024-3400, FortiClient CVE-2023-48788, and Apache Solr CVE-2023-50386. Some solid fixes and enhancements too! 🐚 rapid7.com/blog/post/2024/04/2

  • 0
  • 2
  • 10 hours ago

CVE-2023-48788

KEV
Fortinet FortiClientEMS
12 Mar 2024
Published
19 Mar 2024
Updated
CVSS v3.1
CRITICAL (9.3)
  • 1 Post
  • 2 Interactions

CVE Info

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
MITRE
NVD

Fediverse

Profile picture
Caitlin Condon@catc0n

Good haul this week, including modules for PAN-OS CVE-2024-3400, FortiClient CVE-2023-48788, and Apache Solr CVE-2023-50386. Some solid fixes and enhancements too! 🐚 rapid7.com/blog/post/2024/04/2

  • 0
  • 2
  • 10 hours ago

CVE-2023-41266

KEV
Pending
29 Aug 2023
Published
29 Aug 2023
Updated
CVSS v3.1
HIGH (8.2)
  • 1 Post
  • 2 Interactions

CVE Info

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

Cactus Ransomware Exploits Qlik Vulnerabilities for Initial Access Mega Toot

This was reported last year by Arctic Wolf as Cactus Ransomware was actively exploiting Qlik Sense servers for initial access. The vulnerabilities are as follows:

  • CVE-2023-41266 (vendor 8.2 high/NVD 6.5 medium) path traversal, disclosed ~29 August 2023?, added to CISA KEV Catalog 07 December 2023
  • CVE-2023-41265 (vendor 9.6 critical/NVD 9.9 critical) also known as ZeroQlik ... HTTP Request Tunneling vulnerability, disclosed ~29 August 2023?, added to KEV 07 December 2023
  • CVE-2023-48365 (vendor 9.6 critical/NVD 9.9 critical) also known as DoubleQlik ... EoP and a patch bypass of CVE-2023-41265, disclosed 15 November 2023

Project Melissa, a public-private partnership against ransomware, identified 3100 vulnerable servers worldwide and notified their organizations. 122 of these servers were actively being exploited.

  • 1
  • 1
  • 17 hours ago

CVE-2023-41265

KEV
Pending
29 Aug 2023
Published
29 Aug 2023
Updated
CVSS v3.1
CRITICAL (9.6)
  • 1 Post
  • 2 Interactions

CVE Info

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

Cactus Ransomware Exploits Qlik Vulnerabilities for Initial Access Mega Toot

This was reported last year by Arctic Wolf as Cactus Ransomware was actively exploiting Qlik Sense servers for initial access. The vulnerabilities are as follows:

  • CVE-2023-41266 (vendor 8.2 high/NVD 6.5 medium) path traversal, disclosed ~29 August 2023?, added to CISA KEV Catalog 07 December 2023
  • CVE-2023-41265 (vendor 9.6 critical/NVD 9.9 critical) also known as ZeroQlik ... HTTP Request Tunneling vulnerability, disclosed ~29 August 2023?, added to KEV 07 December 2023
  • CVE-2023-48365 (vendor 9.6 critical/NVD 9.9 critical) also known as DoubleQlik ... EoP and a patch bypass of CVE-2023-41265, disclosed 15 November 2023

Project Melissa, a public-private partnership against ransomware, identified 3100 vulnerable servers worldwide and notified their organizations. 122 of these servers were actively being exploited.

  • 1
  • 1
  • 17 hours ago

CVE-2023-48365

Pending
15 Nov 2023
Published
15 Nov 2023
Updated
CVSS v3.1
CRITICAL (9.6)
  • 1 Post
  • 2 Interactions

CVE Info

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
MITRE
NVD

Fediverse

Profile picture
Not Simon 🐐@screaminggoat

Cactus Ransomware Exploits Qlik Vulnerabilities for Initial Access Mega Toot

This was reported last year by Arctic Wolf as Cactus Ransomware was actively exploiting Qlik Sense servers for initial access. The vulnerabilities are as follows:

  • CVE-2023-41266 (vendor 8.2 high/NVD 6.5 medium) path traversal, disclosed ~29 August 2023?, added to CISA KEV Catalog 07 December 2023
  • CVE-2023-41265 (vendor 9.6 critical/NVD 9.9 critical) also known as ZeroQlik ... HTTP Request Tunneling vulnerability, disclosed ~29 August 2023?, added to KEV 07 December 2023
  • CVE-2023-48365 (vendor 9.6 critical/NVD 9.9 critical) also known as DoubleQlik ... EoP and a patch bypass of CVE-2023-41265, disclosed 15 November 2023

Project Melissa, a public-private partnership against ransomware, identified 3100 vulnerable servers worldwide and notified their organizations. 122 of these servers were actively being exploited.

  • 1
  • 1
  • 17 hours ago

CVE-2024-29966

Brocade SANnav
19 Apr 2024
Published
19 Apr 2024
Updated
CVSS v3.1
HIGH (7.5)
  • 1 Post
  • 1 Interaction

CVE Info

Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.
MITRE
NVD

Fediverse

Profile picture
Aida Akl@AAKL

Maybe it's just easier to create the flaws first and then attach the rest of the software. #infosec #cybersecurity

CVE-2024-2859; CVE-2024-29960; CVE-2024-29961; CVE-2024-29963; CVE-2024-29966

Severe Flaws Disclosed in #Brocade SANnav SAN Management Software - all 18 of them thehackernews.com/2024/04/seve @thehackernews

  • 0
  • 1
  • 17 hours ago

CVE-2024-2859

Brocade SANnav
27 Apr 2024
Published
27 Apr 2024
Updated
CVSS v3.1
MEDIUM (6.8)
  • 1 Post
  • 1 Interaction

CVE Info

By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account.
MITRE
NVD

Fediverse

Profile picture
Aida Akl@AAKL

Maybe it's just easier to create the flaws first and then attach the rest of the software. #infosec #cybersecurity

CVE-2024-2859; CVE-2024-29960; CVE-2024-29961; CVE-2024-29963; CVE-2024-29966

Severe Flaws Disclosed in #Brocade SANnav SAN Management Software - all 18 of them thehackernews.com/2024/04/seve @thehackernews

  • 0
  • 1
  • 17 hours ago

CVE-2024-29963

Brocade SANnav
19 Apr 2024
Published
26 Apr 2024
Updated
CVSS v3.1
LOW (1.9)
  • 1 Post
  • 1 Interaction

CVE Info

Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.
MITRE
NVD

Fediverse

Profile picture
Aida Akl@AAKL

Maybe it's just easier to create the flaws first and then attach the rest of the software. #infosec #cybersecurity

CVE-2024-2859; CVE-2024-29960; CVE-2024-29961; CVE-2024-29963; CVE-2024-29966

Severe Flaws Disclosed in #Brocade SANnav SAN Management Software - all 18 of them thehackernews.com/2024/04/seve @thehackernews

  • 0
  • 1
  • 17 hours ago

CVE-2024-29961

Brocade SANnav
19 Apr 2024
Published
19 Apr 2024
Updated
CVSS v3.1
HIGH (8.2)
  • 1 Post
  • 1 Interaction

CVE Info

A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.
MITRE
NVD

Fediverse

Profile picture
Aida Akl@AAKL

Maybe it's just easier to create the flaws first and then attach the rest of the software. #infosec #cybersecurity

CVE-2024-2859; CVE-2024-29960; CVE-2024-29961; CVE-2024-29963; CVE-2024-29966

Severe Flaws Disclosed in #Brocade SANnav SAN Management Software - all 18 of them thehackernews.com/2024/04/seve @thehackernews

  • 0
  • 1
  • 17 hours ago

CVE-2024-29960

Brocade SANnav
19 Apr 2024
Published
26 Apr 2024
Updated
CVSS v3.1
MEDIUM (6.8)
  • 1 Post
  • 1 Interaction

CVE Info

In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.
MITRE
NVD

Fediverse

Profile picture
Aida Akl@AAKL

Maybe it's just easier to create the flaws first and then attach the rest of the software. #infosec #cybersecurity

CVE-2024-2859; CVE-2024-29960; CVE-2024-29961; CVE-2024-29963; CVE-2024-29966

Severe Flaws Disclosed in #Brocade SANnav SAN Management Software - all 18 of them thehackernews.com/2024/04/seve @thehackernews

  • 0
  • 1
  • 17 hours ago