VULNERA Pulse

Apache — OFBiz

CVE-2024-32113 / Added: Aug. 7, 2024

CRITICAL CVSS 9.80 EPSS Score 97.01 EPSS Percentile 99.78

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

Headlines

• Aug. 9, 2024 - CISA adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog
• Aug. 8, 2024 - CISA warns about actively exploited Apache OFBiz RCE flaw
• Aug. 6, 2024 - New Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution
• Aug. 5, 2024 - Researchers warn of a new critical Apache OFBiz flaw
• Aug. 5, 2024 - Critical Vulnerability in Apache OFBiz Requires Immediate Patching
• Aug. 5, 2024 - Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)
• Aug. 1, 2024 - Actively Exploited Apache OFBiz Flaw Triggers Urgent Security Alert
• May 14, 2024 - SecLists.Org Security Mailing List Archive
• May 13, 2024 - CVE-2024-32113 - RCE Vulnerability in Apache OFBiz: Immediate Action Required

Back to top ↑

Android — Kernel

CVE-2024-36971 / Added: Aug. 7, 2024

HIGH CVSS 7.80 EPSS Score 0.10 EPSS Percentile 43.58

Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.

Headlines

• Aug. 9, 2024 - CISA adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog
• Aug. 8, 2024 - CISA warns about actively exploited Apache OFBiz RCE flaw
• Aug. 7, 2024 - Multiple Vulnerabilities in Google Android OS Could Allow for Privilege Escalation
• Aug. 6, 2024 - Google fixes Android kernel RCE bug under active exploit
• Aug. 6, 2024 - Google fixes Android kernel RCE bug under active exploit
• Aug. 6, 2024 - Google warns of an actively exploited Android kernel flaw
• Aug. 6, 2024 - Google Patches New Android Kernel Vulnerability Exploited in the Wild
• Aug. 6, 2024 - CVE-2024-36971: Zero-Day Kernel Flaw Exploited in Targeted Attacks Against Android Devices
• Aug. 5, 2024 - Google fixes Android kernel zero-day exploited in targeted attacks

Back to top ↑

Microsoft — Windows

CVE-2018-0824 / Added: Aug. 5, 2024

HIGH CVSS 8.80 EPSS Score 97.03 EPSS Percentile 99.79

Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.

Headlines

• Aug. 6, 2024 - CISA adds Microsoft COM for Windows bug to its Known Exploited Vulnerabilities catalog
• Aug. 6, 2024 - Google Patches New Android Kernel Vulnerability Exploited in the Wild
• Aug. 6, 2024 - CISA Warns of Actively Exploited Microsoft COM for Windows Flaw
• Aug. 5, 2024 - China-linked APT41 breached Taiwanese research institute
• Aug. 5, 2024 - Google gamed into advertising a malicious Authenticator
• Aug. 2, 2024 - China's APT41 Targets Taiwan Research Institute for Cyber Espionage
• Aug. 2, 2024 - APT41 Hackers Use ShadowPad, Cobalt Strike in Taiwanese Institute Cyber Attack
• Aug. 2, 2024 - Chinese APT41 Group Breaches Taiwanese Research Institute
• Aug. 1, 2024 - There is no real fix to the security issues recently found in GitHub and other similar software
• Aug. 1, 2024 - APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Back to top ↑

CVE-2024-32113

CRITICAL CVSS 9.80 EPSS Score 97.01 EPSS Percentile 99.78

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: May 8, 2024

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Vendor Impacted: Apache

Product Impacted: Ofbiz

Quotes

• The root cause of the vulnerability lies in a flaw in the authentication mechanism
• Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely on the configuration of their endpoints)

Headlines

• Aug. 9, 2024 - CISA adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog
• Aug. 8, 2024 - CISA warns about actively exploited Apache OFBiz RCE flaw
• Aug. 6, 2024 - New Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution
• Aug. 5, 2024 - Researchers warn of a new critical Apache OFBiz flaw
• Aug. 5, 2024 - Critical Vulnerability in Apache OFBiz Requires Immediate Patching
• Aug. 5, 2024 - Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)

CVE-2024-20450

CRITICAL CVSS 9.80

Risk Context N/A

Published: Aug. 7, 2024

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.

Quotes

• Cisco has not released and will not release software updates to address the vulnerabilities that are described in this advisory
• A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level
• Acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature

Headlines

• Aug. 9, 2024 - CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature
• Aug. 9, 2024 - It's time to junk your Cisco SPA300 and SPA500 IP phones
• Aug. 8, 2024 - Cisco warns of critical RCE zero-days in end of life IP phones
• Aug. 8, 2024 - Cisco Small Business IP Phones Affected by Critical Vulnerabilities, No Patch!

CVE-2018-0824

HIGH CVSS 8.80 EPSS Score 97.03 EPSS Percentile 99.79

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: May 9, 2018

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Vendor Impacted: Microsoft

Products Impacted: Windows 8.1, Windows 10, Windows Rt 8.1, Windows, Windows Server 2008, Windows Server 2016, Windows 7, Windows Server 2012

Quotes

• A remote code execution vulnerability exists in
• Some unknown individual was able to impersonate Google and successfully push malware disguised as a branded Google product as well
• Cisco Talos assesses with medium confidence that this campaign is carried out by APT41, alleged by the U.S. government to be comprised of Chinese nationals. This assessment is based primarily on overlaps in tactics, techniques and procedures (TTPs), infrastructure and malware families used exclusively by Chinese APT groups

Headlines

• Aug. 6, 2024 - CISA adds Microsoft COM for Windows bug to its Known Exploited Vulnerabilities catalog
• Aug. 6, 2024 - Google Patches New Android Kernel Vulnerability Exploited in the Wild
• Aug. 6, 2024 - CISA Warns of Actively Exploited Microsoft COM for Windows Flaw
• Aug. 5, 2024 - China-linked APT41 breached Taiwanese research institute
• Aug. 5, 2024 - Google gamed into advertising a malicious Authenticator

CVE-2024-38856

HIGH CVSS 8.10 EPSS Score 0.07 EPSS Percentile 31.13

Remote Code Execution Public Exploits Available

Published: Aug. 5, 2024

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Quotes

• The root cause of the vulnerability lies in a flaw in the authentication mechanism
• [CVE-2024-38856] exposes critical endpoints to unauthenticated threat actors using a crafted request, paving the way for remote code execution
• Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely on the configuration of their endpoints)

Headlines

• Aug. 8, 2024 - CISA warns about actively exploited Apache OFBiz RCE flaw
• Aug. 8, 2024 - PoC Exploit Released for Apache OFBiz Remote Code Execution Flaw (CVE-2024-38856)
• Aug. 6, 2024 - New Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution
• Aug. 6, 2024 - Pimax VR Security Breach: Hackers Could Exploit CVE-2024-41889 to Take Control
• Aug. 5, 2024 - Critical Apache OfBiz Vulnerability Allows Preauth RCE
• Aug. 5, 2024 - Researchers warn of a new critical Apache OFBiz flaw
• Aug. 5, 2024 - Critical Vulnerability in Apache OFBiz Requires Immediate Patching
• Aug. 5, 2024 - Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)
• Aug. 5, 2024 - CVE-2024-38856: Critical Apache OFBiz Flaw Opens Door to Unauthorized Code Execution

CVE-2024-36971

HIGH CVSS 7.80 EPSS Score 0.10 EPSS Percentile 43.58

CISA Known Exploited Remote Code Execution

Published: June 10, 2024

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

Vendors Impacted: Linux, Android

Products Impacted: Kernel, Linux Kernel

Quotes

• Remote code execution with System execution privileges needed
• There are indications that CVE-2024-36971 may be under limited, targeted exploitation

Headlines

• Aug. 9, 2024 - CISA adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog
• Aug. 8, 2024 - CISA warns about actively exploited Apache OFBiz RCE flaw
• Aug. 7, 2024 - Multiple Vulnerabilities in Google Android OS Could Allow for Privilege Escalation
• Aug. 6, 2024 - Google fixes Android kernel RCE bug under active exploit
• Aug. 6, 2024 - Google warns of an actively exploited Android kernel flaw
• Aug. 6, 2024 - Google Patches New Android Kernel Vulnerability Exploited in the Wild
• Aug. 6, 2024 - CVE-2024-36971: Zero-Day Kernel Flaw Exploited in Targeted Attacks Against Android Devices
• Aug. 5, 2024 - Google fixes Android kernel zero-day exploited in targeted attacks

CVE-2024-38202

HIGH CVSS 7.30

Risk Context N/A

Published: Aug. 8, 2024

Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Backup, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft is developing a security update to mitigate this threat, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE. This CVE will be updated, and customers will be notified when the official mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs. Details A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Backup potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability. Microsoft is developing a security update that will mitigate this vulnerability, but it is not yet available. This CVE will be updated with new information and links to the security updates once available. We highly encourage customers subscribe to Security Update Guide notifications to be a...
Please see the NVD entry for the full description.

Quotes

• Attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS)
• I then looked at the security attributes of this key and noticed that it is not Trusted Installer enforced! This would allow me to control all the update actions
• I discovered multiple ways to disable Windows virtualization-based security (VBS), including its features such as Credential Guard and Hypervisor-Protected Code integrity (HVCI), even when enforced with UEFI locks. To my knowledge, this is the first time VBS's UEFI locks have been bypassed without physical access

Headlines

• Aug. 8, 2024 - Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
• Aug. 8, 2024 - "Perfect" Windows downgrade attack turns fixed vulnerabilities into zero-days
• Aug. 8, 2024 - CVE-2024-21302, CVE-2024-38202: Zero-Day Vulnerabilities Expose Windows Systems to "Unpatching" Attacks
• Aug. 7, 2024 - Windows Update downgrade attack "unpatches" fully-updated systems

CVE-2024-21302

MEDIUM CVSS 6.70

Remote Code Execution

Published: Aug. 8, 2024

Summary: Microsoft was notified that an elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS) including a subset of Azure Virtual Machine SKUS; enabling an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn.. Microsoft is developing a security update to mitigate this vulnerability, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE. This CVE will be updated when the mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 , and a subset of Azure Virtual Machines (VM) SKUs with a Windows based guestOS supporting VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated...
Please see the NVD entry for the full description.

Quotes

• Attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS)
• I then looked at the security attributes of this key and noticed that it is not Trusted Installer enforced! This would allow me to control all the update actions
• I discovered multiple ways to disable Windows virtualization-based security (VBS), including its features such as Credential Guard and Hypervisor-Protected Code integrity (HVCI), even when enforced with UEFI locks. To my knowledge, this is the first time VBS's UEFI locks have been bypassed without physical access

Headlines

• Aug. 8, 2024 - Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
• Aug. 8, 2024 - "Perfect" Windows downgrade attack turns fixed vulnerabilities into zero-days
• Aug. 8, 2024 - CVE-2024-21302, CVE-2024-38202: Zero-Day Vulnerabilities Expose Windows Systems to "Unpatching" Attacks
• Aug. 7, 2024 - Windows Update downgrade attack "unpatches" fully-updated systems

CVE-2024-42009

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 16.20

Risk Context N/A

Published: Aug. 5, 2024

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Quotes

• When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's browser
• These allow an unauthenticated attacker to steal emails and contacts, as well as send emails from a victim’s account. All the victim user has to do is view a malicious email in Roundcube
• No user interaction beyond viewing the attacker’s email is required to exploit [CVE-2024-42009]. For CVE-2024-42008, a single click by the victim is needed for the exploit to work, but the attacker can make this interaction unobvious for the user

Headlines

• Aug. 7, 2024 - Critical XSS bug in Roundcube Webmail allows attackers to steal emails and sensitive data
• Aug. 7, 2024 - Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords
• Aug. 7, 2024 - Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)
• Aug. 5, 2024 - Roundcube Webmail Releases Security Updates to Patch Multiple Vulnerabilities

CVE-2024-42008

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 16.20

Risk Context N/A

Published: Aug. 5, 2024

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Quotes

• When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's browser
• These allow an unauthenticated attacker to steal emails and contacts, as well as send emails from a victim’s account. All the victim user has to do is view a malicious email in Roundcube
• No user interaction beyond viewing the attacker’s email is required to exploit [CVE-2024-42009]. For CVE-2024-42008, a single click by the victim is needed for the exploit to work, but the attacker can make this interaction unobvious for the user

Headlines

• Aug. 7, 2024 - Critical XSS bug in Roundcube Webmail allows attackers to steal emails and sensitive data
• Aug. 7, 2024 - Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords
• Aug. 7, 2024 - Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)
• Aug. 5, 2024 - Roundcube Webmail Releases Security Updates to Patch Multiple Vulnerabilities