VULNERA Pulse

Acclaim Systems — USAHERDS

CVE-2021-44207 / Added: Dec. 23, 2024

HIGH CVSS 8.10 EPSS Score 0.78 EPSS Percentile 81.22

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.

Headlines

• Dec. 24, 2024 - CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation
• Dec. 24, 2024 - CVE-2021-44207: Vulnerability in Acclaim USAHERDS Actively Exploited, CISA Warns
• Dec. 23, 2024 - U.S. CISA adds Acclaim Systems USAHERDS flaw to its Known Exploited Vulnerabilities catalog
• March 8, 2022 - APT41 Targeting U.S. State Government Networks | Mandiant

Back to top ↑

CVE-2024-45387

CRITICAL CVSS 9.90 EPSS Score 0.04 EPSS Percentile 10.94

Remote Code Execution

Published: Dec. 23, 2024

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

Quotes

• The ObjectSerializationDecoder in Apache MINA uses Java's native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses
• An SQL injection vulnerability in Traffic Ops… allows a privileged user with role ‘admin’, ‘federation’, ‘operations’, ‘portal’, or ‘steering’ to execute arbitrary SQL against the database by sending a specially-crafted PUT request
• An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role 'admin,' 'federation,' 'operations,' 'portal,' or 'steering' to execute arbitrary SQL against the database by sending a specially-crafted PUT request

Headlines

• Dec. 27, 2024 - Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization
• Dec. 26, 2024 - Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
• Dec. 26, 2024 - Apache fixed a critical SQL Injection in Apache Traffic Control
• Dec. 25, 2024 - Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now
• Dec. 25, 2024 - CVE-2024-45387 (CVSS 9.9): Critical SQL Injection Vulnerability Found in Apache Traffic Control

CVE-2024-50379

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 10.94

Remote Code Execution Public Exploits Available

Published: Dec. 17, 2024

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Quotes

• Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat

Headlines

• Dec. 24, 2024 - Apache Foundation fixed a severe Tomcat vulnerability
• Dec. 24, 2024 - Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks
• Dec. 23, 2024 - Apache fixes remote code execution bypass in Tomcat web server
• Dec. 23, 2024 - CVE-2024-56337: Apache Tomcat Patches Critical RCE Vulnerability

CVE-2024-12356

CRITICAL CVSS 9.80 EPSS Score 1.30 EPSS Percentile 85.59

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 17, 2024

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Vendor Impacted: Beyondtrust

Products Impacted: Privileged Remote Access (Pra) And Remote Support (Rs) , Remote Support, Privileged Remote Access

Quotes

• Signal or a similar app
• Subverts user choice and is wrong

Headlines

• Dec. 23, 2024 - ⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips
• Dec. 23, 2024 - ICO puts foot down on Google's planned fingerprinting change
• Dec. 22, 2024 - Week in review: MUT-1244 targets both security workers and threat actors, Kali Linux 2024.4 released

CVE-2018-17532

CRITICAL CVSS 9.80 EPSS Score 1.46 EPSS Percentile 86.43

Risk Context N/A

Published: Oct. 15, 2018

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.

Vendor Impacted: Teltonika

Products Impacted: Rut955, Rut900, Rut950 Firmware, Rut900 Firmware, Rut955 Firmware, Rut950

Quotes

• Further investigation into this campaign revealed a new botnet that calls itself the
• Although employing complex decryption methods isn't new, it suggests evolving tactics, techniques, and procedures among Mirai-based botnet operators
• Although employing complex decryption methods isn’t new, it suggests evolving tactics, techniques, and procedures among Mirai-based botnet operators

Headlines

• Dec. 26, 2024 - A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs
• Dec. 24, 2024 - New botnet exploits vulnerabilities in NVRs, TP-Link routers
• Dec. 23, 2024 - DigiEver DVR Vulnerability Under Attack by Hail Cock Botnet

CVE-2023-1389

HIGH CVSS 8.80 EPSS Score 8.72 EPSS Percentile 94.52

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 15, 2023

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Vendor Impacted: Tp-Link

Products Impacted: Archer Ax21 Firmware, Archer Ax21

Quotes

• Further investigation into this campaign revealed a new botnet that calls itself the
• Although employing complex decryption methods isn't new, it suggests evolving tactics, techniques, and procedures among Mirai-based botnet operators
• Although employing complex decryption methods isn’t new, it suggests evolving tactics, techniques, and procedures among Mirai-based botnet operators

Headlines

• Dec. 26, 2024 - A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs
• Dec. 24, 2024 - New botnet exploits vulnerabilities in NVRs, TP-Link routers
• Dec. 23, 2024 - DigiEver DVR Vulnerability Under Attack by Hail Cock Botnet

CVE-2018-0802

HIGH CVSS 7.80 EPSS Score 95.56 EPSS Percentile 99.56

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 10, 2018

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

Vendor Impacted: Microsoft

Products Impacted: Office Compatibility Pack, Word, Office

Quotes

• Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formula editor (CVE-2018-0802) to download and execute malware code
• This new campaign loads VBCloud via VBShower, which also downloads the PowerShower module. PowerShower probes the local network and facilitates further infiltration, while VBCloud collects information about the system and steals files

Headlines

• Dec. 27, 2024 - Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia
• Dec. 25, 2024 - Cloud Atlas Deploys VBCloud backdoor in Latest Cyber Espionage Campaign
• Dec. 23, 2024 - Cloud Atlas using a new backdoor, VBCloud, to steal data

CVE-2024-53961

HIGH CVSS 7.40 EPSS Score 0.09 EPSS Percentile 40.36

Actively Exploited

Published: Dec. 23, 2024

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data.

Quotes

• These keys are used to provide security for the application ViewState
• Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read
• Adobe has released security updates for ColdFusion versions 2023 and 2021. These updates resolve a critical vulnerability that could lead to arbitrary file system read

Headlines

• Dec. 24, 2024 - Adobe is aware that ColdFusion bug CVE-2024-53961 has a known PoC exploit code
• Dec. 24, 2024 - CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation
• Dec. 24, 2024 - PoC Exploit Emerges for Adobe ColdFusion CVE-2024-53961—Apply Security Updates Now
• Dec. 23, 2024 - Adobe warns of critical ColdFusion bug with PoC exploit code

CVE-2024-56337

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 10.94

Risk Context N/A

Published: Dec. 20, 2024

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Quotes

• The ObjectSerializationDecoder in Apache MINA uses Java's native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses
• An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role 'admin,' 'federation,' 'operations,' 'portal,' or 'steering' to execute arbitrary SQL against the database by sending a specially-crafted PUT request

Headlines

• Dec. 27, 2024 - Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization
• Dec. 25, 2024 - Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now
• Dec. 24, 2024 - Apache Foundation fixed a severe Tomcat vulnerability
• Dec. 24, 2024 - Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks
• Dec. 23, 2024 - Apache fixes remote code execution bypass in Tomcat web server
• Dec. 23, 2024 - CVE-2024-56337: Apache Tomcat Patches Critical RCE Vulnerability

CVE-2024-3393

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 10.94

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Dec. 27, 2024

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Vendor Impacted: Palo Alto Networks

Product Impacted: Pan-Os

Quotes

• A denial-of-service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall
• A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode

Headlines

• Dec. 27, 2024 - Hackers exploit DoS flaw to disable Palo Alto Networks firewalls
• Dec. 27, 2024 - Palo Alto Networks fixed a high-severity PAN-OS flaw
• Dec. 27, 2024 - Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately
• Dec. 27, 2024 - CVE-2024-3393: PAN-OS Vulnerability Now Exploited in the Wild

CVE-2024-43441

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 10.94

Risk Context N/A

Published: Dec. 24, 2024

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Quotes

• The ObjectSerializationDecoder in Apache MINA uses Java's native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses
• An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role 'admin,' 'federation,' 'operations,' 'portal,' or 'steering' to execute arbitrary SQL against the database by sending a specially-crafted PUT request

Headlines

• Dec. 27, 2024 - Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization
• Dec. 26, 2024 - Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
• Dec. 26, 2024 - CVE-2024-43441: Authentication Bypass Vulnerability Found in Apache HugeGraph-Server
• Dec. 25, 2024 - Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now