Snapshot
Aug. 10, 2024 - Aug. 16, 2024
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2024-28986 | SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. | CRITICAL | SolarWinds | Aug. 15, 2024 |
| CVE-2024-38189 | Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. | HIGH | Microsoft | Aug. 13, 2024 |
| CVE-2024-38193 | Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. | HIGH | Microsoft | Aug. 13, 2024 |
| CVE-2024-38107 | Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. | HIGH | Microsoft | Aug. 13, 2024 |
| CVE-2024-38178 | Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. | HIGH | Microsoft | Aug. 13, 2024 |
| CVE-2024-38106 | Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. | HIGH | Microsoft | Aug. 13, 2024 |
| CVE-2024-38213 | Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. | MEDIUM | Microsoft | Aug. 13, 2024 |
Newswires |
||||
|
CISA Issues Warning: SolarWinds' RCE Vulnerability Being Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has raised an alarm about the exploitation of a recently patched critical vulnerability in SolarWinds' Web Help Desk solution. |
Aug. 16, 2024 |
|||
|
ValleyRAT Malware Campaign Targets Chinese Users with Sophisticated Techniques
Researchers from Fortinet FortiGuard Labs, Eduardo Altares and Joie Salvio, have reported an ongoing malware campaign targeting Chinese-speaking users. |
Aug. 16, 2024 |
|||
|
Microsoft Suspends BitLocker Security Patch, Recommends Manual Mitigation
Microsoft has put on hold a solution for a BitLocker security feature bypass vulnerability due to firmware compatibility problems. |
Aug. 15, 2024 |
|||
|
Black Basta Ransomware Group Linked to New Malware Campaign
Rapid7 researchers have identified a new social engineering campaign that is distributing the SystemBC dropper to the Black Basta ransomware operation. |
Aug. 15, 2024 |
|||
|
Critical Zero-Click Windows TCP/IP RCE Vulnerability Affects All IPv6-Enabled Systems: Urgent Patch Needed
Microsoft recently urged its customers to promptly patch a critical TCP/IP remote code execution (RCE) vulnerability that poses a significant risk to all Windows systems where IPv6 is enabled. |
Aug. 14, 2024 |
|||
|
Windows SmartScreen Security Bypass Vulnerability Exploited Since March Now Patched
Microsoft has recently patched a security vulnerability in its SmartScreen feature that had been exploited as a zero-day since March. |
Aug. 13, 2024 |
|||
|
Microsoft's August 2024 Patch Tuesday Addresses Nine Zero-Days, Six Currently Exploited
Microsoft's August 2024 Patch Tuesday has rolled out, featuring security patches for 89 vulnerabilities, among them six that are actively exploited and three that have been publicly disclosed zero-days. |
Aug. 13, 2024 |
|||
|
Ivanti Alerts Customers to Patch Critical Authentication Bypass Vulnerability in Virtual Traffic Manager
Ivanti has called on customers to patch a severe authentication bypass vulnerability that affects its Virtual Traffic Manager (vTM) appliances. |
Aug. 13, 2024 |
|||
|
High-Severity OpenSSH Vulnerability in FreeBSD Addressed with Urgent Patch
The FreeBSD Project has urgently updated its security measures in response to a high-severity vulnerability in OpenSSH. |
Aug. 12, 2024 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2024-38063 (10) | Windows TCP/IP Remote Code Execution Vulnerability | CRITICAL |
Actively Exploited Remote Code Execution Public Exploits Available |
|
| CVE-2024-28986 (9) | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if e... | CRITICAL | Solarwinds |
CISA Known Exploited Actively Exploited Remote Code Execution |
| CVE-2024-38193 (8) | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2024-38107 (7) | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2024-38178 (8) | Scripting Engine Memory Corruption Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2024-38202 (9) | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an... | HIGH | Risk Context N/A | |
| CVE-2024-38106 (7) | Windows Kernel Elevation of Privilege Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2024-21302 (10) | Summary: Microsoft was notified that an elevation of privilege vulnerability exists in Windows based systems supporting Virtu... | MEDIUM | Risk Context N/A | |
| CVE-2024-38213 (12) | Windows Mark of the Web Security Feature Bypass Vulnerability | MEDIUM | Microsoft |
CISA Known Exploited |
| CVE-2024-38200 (9) | Microsoft Office Spoofing Vulnerability | MEDIUM | Microsoft |
Remote Code Execution |
CISA Known Exploited Vulnerabilities
CISA added seven vulnerabilities to the known exploited vulnerabilities list.
Microsoft — Project |
|
CVE-2024-38189 / Added: Aug. 13, 2024 |
|
HIGH CVSS 8.80 EPSS Score 0.52 EPSS Percentile 77.14 |
|
Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. |
|
Headlines
|
Microsoft — Windows |
|
CVE-2024-38193 / Added: Aug. 13, 2024 |
|
HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 10.04 |
|
Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. |
|
Headlines
|
Microsoft — Windows |
|
CVE-2024-38107 / Added: Aug. 13, 2024 |
|
HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 10.04 |
|
Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. |
|
Headlines
|
Microsoft — Windows |
|
CVE-2024-38178 / Added: Aug. 13, 2024 |
|
HIGH CVSS 7.50 EPSS Score 2.30 EPSS Percentile 89.88 |
|
Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. |
|
Headlines
|
Microsoft — Windows |
|
CVE-2024-38106 / Added: Aug. 13, 2024 |
|
HIGH CVSS 7.00 EPSS Score 0.04 EPSS Percentile 10.04 |
|
Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. |
|
Headlines
|
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2024-28986 |
|
CRITICAL CVSS 9.80 EPSS Score 1.87 EPSS Percentile 88.66 |
|
CISA Known Exploited Actively Exploited Remote Code Execution |
|
Published: Aug. 13, 2024 |
|
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available. |
|
Vendor Impacted: Solarwinds |
|
Product Impacted: Web Help Desk |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38193 |
|
HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 10.04 |
|
CISA Known Exploited |
|
Published: Aug. 13, 2024 |
|
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 11 22h2, Windows Server 2019, Windows Server 2012, Windows, Windows 11 21h2, Windows 10 21h2, Windows 10 1607, Windows 11 23h2, Windows 10 1507, Windows 11 24h2, Windows 10 22h2, Windows Server 2022 23h2, Windows Server 2008, Windows Server 2022, Windows Server 2016, Windows 10 1809 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38107 |
|
HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 10.04 |
|
CISA Known Exploited |
|
Published: Aug. 13, 2024 |
|
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 11 22h2, Windows Server 2019, Windows Server 2012, Windows, Windows 11 21h2, Windows 10 21h2, Windows 10 1607, Windows 11 23h2, Windows 10 1507, Windows 11 24h2, Windows 10 22h2, Windows Server 2022 23h2, Windows Server 2022, Windows Server 2016, Windows 10 1809 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38178 |
|
HIGH CVSS 7.50 EPSS Score 2.30 EPSS Percentile 89.88 |
|
CISA Known Exploited |
|
Published: Aug. 13, 2024 |
|
Scripting Engine Memory Corruption Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 11 22h2, Windows Server 2019, Windows Server 2012, Windows, Windows 11 21h2, Windows 10 21h2, Windows 10 1607, Windows 11 23h2, Windows 10 1507, Windows 11 24h2, Windows 10 22h2, Windows Server 2022 23h2, Windows Server 2022, Windows Server 2016, Windows 10 1809 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38202 |
|
HIGH CVSS 7.30 EPSS Score 0.04 EPSS Percentile 9.51 |
|
Risk Context N/A |
|
Published: Aug. 8, 2024 |
|
Summary
Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful.
Microsoft is developing a security update to mitigate this threat, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE.
This CVE will be updated, and customers will be notified when the official mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs.
Details
A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Update potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability.
Microsoft is developing a security update that will mitigate this vulnerability, but it is not yet available. This CVE will be updated with new information and links to the security updates once available. We highly encourage customers subscribe to Security Update Guide notifications to be a...
|
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38106 |
|
HIGH CVSS 7.00 EPSS Score 0.04 EPSS Percentile 10.04 |
|
CISA Known Exploited |
|
Published: Aug. 13, 2024 |
|
Windows Kernel Elevation of Privilege Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 11 22h2, Windows Server 2019, Windows, Windows 11 21h2, Windows 10 21h2, Windows 10 1607, Windows 11 23h2, Windows 10 1507, Windows 11 24h2, Windows 10 22h2, Windows Server 2022 23h2, Windows Server 2022, Windows Server 2016, Windows 10 1809 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-21302 |
|
MEDIUM CVSS 6.70 EPSS Score 0.04 EPSS Percentile 9.51 |
|
Risk Context N/A |
|
Published: Aug. 8, 2024 |
|
Summary:
Microsoft was notified that an elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS.
Microsoft is developing a security update to mitigate this threat, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE.
This CVE will be updated when the mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs.
Update: August 13, 2024
Microsoft has released the August 2024 security updates that include an opt-in revocation policy mitigation to address this vulnerability. Customers running affected versions of Windows are encouraged to review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if this opt-in policy meets the needs of their environment before implementing this mitigation. There are risks associated with this mitigation that should be understood prior to applying it to your systems. Detailed information about these risks is also available in KB5042562.
Details:
A security researcher informed Microsoft of an elevation...
|
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38213 |
|
MEDIUM CVSS 6.50 EPSS Score 1.42 EPSS Percentile 86.75 |
|
CISA Known Exploited |
|
Published: Aug. 13, 2024 |
|
Windows Mark of the Web Security Feature Bypass Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 11 22h2, Windows Server 2019, Windows Server 2012, Windows, Windows 11 21h2, Windows 10 21h2, Windows 10 1607, Windows 11 23h2, Windows 10 1507, Windows 10 22h2, Windows Server 2022 23h2, Windows Server 2022, Windows Server 2016, Windows 10 1809 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38200 |
|
MEDIUM CVSS 6.50 EPSS Score 0.32 EPSS Percentile 70.82 |
|
Remote Code Execution |
|
Published: Aug. 12, 2024 |
|
Microsoft Office Spoofing Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: 365 Apps, Office, Office Long Term Servicing Channel |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
