VULNERA Pulse

CVE-2024-38812

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 40.76

Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 17, 2024

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Vendor Impacted: Vmware

Product Impacted: Vcenter Server

Quotes

• Should I focus on certifications or real-world skills
• Once an attacker controls the range_list->lower value, they effectively control the memory address to which p_array_addr points

Headlines

• Oct. 30, 2024 - SonicWall Details Dangerous RCE Bug in VMware vCenter Server - The Information Technology Daily
• Oct. 28, 2024 - THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27)
• Oct. 28, 2024 - Researcher Details CVE-2024-38812 (CVSS 9.8): Critical RCE Flaw in VMware vCenter
• Oct. 27, 2024 - Week in review: Fortinet patches critical FortiManager 0-day, VMware fixes vCenter Server RCE

CVE-2024-10386

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 9.90

Risk Context N/A

Published: Oct. 25, 2024

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation.

Headlines

• Nov. 1, 2024 - Critical Auth Bugs Expose Smart Factory Gear to Cyberattack
• Nov. 1, 2024 - CISA Warns of Critical Software Vulnerabilities in Industrial Devices
• Oct. 31, 2024 - Rockwell Automation FactoryTalk ThinManager | CISA

CVE-2024-47575

CRITICAL CVSS 9.80 EPSS Score 5.18 EPSS Percentile 93.20

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 23, 2024

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Vendor Impacted: Fortinet

Products Impacted: Fortimanager, Fortimanager Cloud

Quotes

• Hey ESET, Wait for the Leak

Headlines

• Oct. 30, 2024 - Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation | CISA
• Oct. 28, 2024 - THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27)
• Oct. 27, 2024 - newsletter Round 495 by Pierluigi Paganini – INTERNATIONAL EDITION

CVE-2024-50550

HIGH CVSS 8.10 EPSS Score 0.04 EPSS Percentile 9.90

Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 29, 2024

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through 6.5.1.

Quotes

• User simulation feature in the plugin
• This vulnerability highlights the critical importance of ensuring the strength and unpredictability of values that are used as security hashes or nonces
• The plugin suffers from an unauthenticated privilege escalation vulnerability which allows any unauthenticated visitor to gain administrator level access after which malicious plugins could be uploaded and installed

Headlines

• Oct. 31, 2024 - LiteSpeed Cache WordPress plugin bug lets hackers get admin access
• Oct. 31, 2024 - LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites
• Oct. 31, 2024 - Over 6 Million Sites at Risk: Severe Privilege Escalation Flaw CVE-2024-50550 in LiteSpeed Cache Plugin
• Oct. 30, 2024 - LiteSpeed Cache Plugin Vulnerability Poses Admin Access Risk

CVE-2024-10387

HIGH CVSS 7.50 EPSS Score 0.04 EPSS Percentile 9.90

Risk Context N/A

Published: Oct. 25, 2024

CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in Denial-of-Service.

Headlines

• Nov. 1, 2024 - Critical Auth Bugs Expose Smart Factory Gear to Cyberattack
• Nov. 1, 2024 - CISA Warns of Critical Software Vulnerabilities in Industrial Devices
• Oct. 31, 2024 - Rockwell Automation FactoryTalk ThinManager | CISA

CVE-2024-38094

HIGH CVSS 7.20 EPSS Score 3.49 EPSS Percentile 91.76

CISA Known Exploited Actively Exploited Remote Code Execution

Published: July 9, 2024

Microsoft SharePoint Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Sharepoint Server, Sharepoint

Quotes

• Should I focus on certifications or real-world skills
• Exploitation for initial access has been a common theme in 2024, often requiring security tooling and efficient response procedures to avoid major impact

Headlines

• Nov. 1, 2024 - CVE-2024-38094 Exploited: Attackers Gain Domain Access via Microsoft SharePoint Server
• Oct. 28, 2024 - THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27)
• Oct. 27, 2024 - Week in review: Fortinet patches critical FortiManager 0-day, VMware fixes vCenter Server RCE

CVE-2024-38030

MEDIUM CVSS 6.50 EPSS Score 0.45 EPSS Percentile 75.56

Risk Context N/A

Published: July 9, 2024

Windows Themes Spoofing Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 11 21h2, Windows 10 21h2, Windows 10 1507, Windows 10 1607, Windows 10 22h2, Windows Server 2016, Windows 10 1809, Windows 11 22h2, Windows Server 2012, Windows 11 23h2, Windows Server 2019, Windows Server 2022

Quotes

• We're aware of this report and will take action as needed to help keep customers protected
• The themes file format is an .ini file, with multiple 'key,value' pairs. I originally found two key,value pairs that could accept file paths
• Merely seeing a malicious theme file listed in a folder [in Windows Explorer] or placed on the desktop would be enough for leaking user’s credentials without any additional user action
• An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file
• When a theme file specified a network file path for some of the theme properties (specifically BrandImage and Wallpaper), Windows would automatically send authenticated network requests to remote hosts, including user’s NTLM credentials when such theme file would be viewed in Windows Explorer

Headlines

• Oct. 30, 2024 - Windows Themes 0-day opens door to NTLM credential theft
• Oct. 30, 2024 - 0patch Uncovers and Patches New Windows Zero-Day Vulnerability, Microsoft Scrambles to Re-Fix Flaw
• Oct. 29, 2024 - Recurring Windows Flaw Could Expose User Credentials
• Oct. 29, 2024 - New Windows Themes zero-day gets free, unofficial patches
• Oct. 29, 2024 - Patching problems: The "return" of a Windows Themes spoofing vulnerability

CVE-2024-21320

MEDIUM CVSS 6.50 EPSS Score 0.17 EPSS Percentile 54.56

Public Exploits Available

Published: Jan. 9, 2024

Windows Themes Spoofing Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 11 21h2, Windows 10 21h2, Windows 10 1507, Windows 10 1607, Windows 10 22h2, Windows Server 2016, Windows 10 1809, Windows 11 22h2, Windows Server 2012, Windows 11 23h2, Windows Server 2019, Windows Server 2022

Quotes

• We're aware of this report and will take action as needed to help keep customers protected
• The themes file format is an .ini file, with multiple 'key,value' pairs. I originally found two key,value pairs that could accept file paths
• Merely seeing a malicious theme file listed in a folder [in Windows Explorer] or placed on the desktop would be enough for leaking user’s credentials without any additional user action
• An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file
• When a theme file specified a network file path for some of the theme properties (specifically BrandImage and Wallpaper), Windows would automatically send authenticated network requests to remote hosts, including user’s NTLM credentials when such theme file would be viewed in Windows Explorer

Headlines

• Oct. 30, 2024 - Windows Themes 0-day opens door to NTLM credential theft
• Oct. 30, 2024 - 0patch Uncovers and Patches New Windows Zero-Day Vulnerability, Microsoft Scrambles to Re-Fix Flaw
• Oct. 29, 2024 - Recurring Windows Flaw Could Expose User Credentials
• Oct. 29, 2024 - New Windows Themes zero-day gets free, unofficial patches
• Oct. 29, 2024 - Patching problems: The "return" of a Windows Themes spoofing vulnerability

CVE-2024-20481

MEDIUM CVSS 5.80 EPSS Score 0.23 EPSS Percentile 61.28

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Oct. 23, 2024

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Vendor Impacted: Cisco

Products Impacted: Adaptive Security Appliance Software, Adaptive Security Appliance (Asa) And Firepower Threat Defense (Ftd), Firepower Threat Defense Software

Quotes

• Should I focus on certifications or real-world skills
• It worked so magically that the hourly 500K failures lowered to 170! over last night!

Headlines

• Oct. 30, 2024 - New Cisco Security Features Combat Password Spraying Attacks - The Information Technology Daily
• Oct. 28, 2024 - THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27)
• Oct. 27, 2024 - Week in review: Fortinet patches critical FortiManager 0-day, VMware fixes vCenter Server RCE
• Oct. 26, 2024 - New Cisco ASA and FTD features block VPN brute-force password attacks