VULNERA Pulse

Adobe — Commerce and Magento Open Source

CVE-2024-34102 / Added: July 17, 2024

CRITICAL CVSS 9.80 EPSS Score 97.32 EPSS Percentile 99.89

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

Headlines

• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - CISA Adds Three New Vulnerabilities to Known Exploited Vulnerabilities Catalog
• July 16, 2024 - Critical Magento Flaw Exploited: CosmicSting (CVE-2024-34102) Strikes Global Brands
• June 26, 2024 - Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack
• June 21, 2024 - CosmicSting (CVE-2024-34102): A Critical E-Commerce Vulnerability Threatening Millions of Online Stores
• June 20, 2024 - CosmicSting flaw impacts 75% of Adobe Commerce, Magento sites
• June 13, 2024 - Adobe Patches Critical Flaws in Multiple Products, Urging Users to Update

Back to top ↑

SolarWinds — Serv-U

CVE-2024-28995 / Added: July 17, 2024

HIGH CVSS 7.50 EPSS Score 96.00 EPSS Percentile 99.51

SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.

Headlines

• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 19, 2024 - SolarWinds Patches 11 Critical Flaws in Access Rights Manager Software
• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - CISA Adds Three New Vulnerabilities to Known Exploited Vulnerabilities Catalog
• June 23, 2024 - newsletter Round 477 by Pierluigi Paganini – INTERNATIONAL EDITION
• June 23, 2024 - Threat actors exploited SolarWinds Serv-U bug CVE-2024-28995
• June 21, 2024 - SolarWinds Serv-U Vulnerability Under Active Attack - Patch Immediately
• June 20, 2024 - SolarWinds Serv-U path-traversal flaw actively exploited in attacks
• June 20, 2024 - GreyNoise Warns of Active Exploitation Attempts Targeting SolarWinds Serv-U Vulnerability (CVE-2024-28995)
• June 12, 2024 - Microsoft fixes hack-me-via-Wi-Fi Windows security hole
• June 9, 2024 - Week in review: Atlassian Confluence RCE PoC, new Kali Linux, Patch Tuesday forecast
• June 7, 2024 - SolarWinds fixes severe Serv-U vulnerability (CVE-2024-28995)

Back to top ↑

VMware — vCenter Server

CVE-2022-22948 / Added: July 17, 2024

MEDIUM CVSS 6.50 EPSS Score 0.78 EPSS Percentile 81.55

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.

Headlines

• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 21, 2024 - U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog
• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - CISA Adds Three New Vulnerabilities to Known Exploited Vulnerabilities Catalog
• June 19, 2024 - Chinese Cyber Espionage Group Exploits Fortinet and VMware Zero-Days
• June 14, 2023 - Chinese attackers exploiting unpatched VMware ESXi instances
• June 13, 2023 - VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant

Back to top ↑

OSGeo — GeoServer

CVE-2024-36401 / Added: July 15, 2024

CRITICAL CVSS 9.80 EPSS Score 94.64 EPSS Percentile 99.28

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

Headlines

• July 17, 2024 - CISA: Patch Critical GeoServer GeoTools Bug Now
• July 16, 2024 - CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks
• July 16, 2024 - CISA adds OSGeo GeoServer GeoTools bug to its Known Exploited Vulnerabilities catalog
• July 16, 2024 - CISA Warns of Actively Exploited RCE Flaw in GeoServer GeoTools Software
• July 15, 2024 - CVE-2024-36401 (CVSS 9.8): Critical GeoServer Flaw Under Active Attack, PoC Available
• July 3, 2024 - CVE-2024-36401 (CVSS 9.8): Urgent Patch Needed for GeoServer RCE Vulnerability

Back to top ↑

CVE-2024-20419

CRITICAL CVSS 10.00 EPSS Score 0.04 EPSS Percentile 9.33

Actively Exploited

Published: July 17, 2024

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

Quotes

• This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device
• A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system
• A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users
• A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device

Headlines

• July 19, 2024 - Cisco fixed a critical flaw in Security Email Gateway that could allow attackers to add root users
• July 18, 2024 - High-Severity Cisco Bug Grants Attackers Password Access
• July 18, 2024 - Critical Cisco bug allows crims to change admin passwords
• July 18, 2024 - Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419)
• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - A critical flaw in Cisco SSM On-Prem allows attackers to change any user's password
• July 17, 2024 - Cisco SSM On-Prem bug lets hackers change any user's password
• July 17, 2024 - CVE-2024-20419 (CVSS 10): Critical Flaw in Cisco Smart Software Manager Opens Door to Account Takeover

CVE-2021-44228

CRITICAL CVSS 10.00 EPSS Score 97.56 EPSS Percentile 100.00

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Bentley, Sonicwall, Netapp, Apache, Intel, Siemens, Fedoraproject, Snowsoftware, Cisco, Debian, Percussion

Products Impacted: Prime Service Catalog, Cloud Connect, Cloudcenter Cost Optimizer, Crosswork Platform Infrastructure, Sentron Powermanager, Fedora, Packaged Contact Center Enterprise, Audio Development Kit, Data Center Network Manager, Crosswork Zero Touch Provisioning, Firepower 4115, Energy Engage, Vm Access Proxy, Dna Center, Nexus Insights, Unified Sip Proxy, Captial, Cloudcenter, Log4j2, Cloud Insights, E-Car Operation Center, Contact Center Domain Manager, Email Security, Dna Spaces\, Video Surveillance Operations Manager, Navigator, Sensor Solution Firmware Development Kit, Siguard Dsa, Workload Optimization Manager, Advanced Malware Protection Virtual Private Cloud Appliance, Evolved Programmable Network Manager, Siveillance Viewpoint, Firepower 4145, Mindsphere, Snapcenter, System Debugger, Common Services Platform Collector, Mendix, Spectrum Power 4, Unified Contact Center Express, Firepower 4140, Identity Services Engine, Ucs Central, Secure Device Onboard, Firepower 2130, Nx, Intersight Virtual Appliance,...

Headlines

• July 16, 2024 - 9 Pro Tips for Better Endpoint Security | Huntress
• July 16, 2024 - Hackers Are Hiding in Plain Sight: Insights from Our 2024 Cyber Threat Report | Huntress
• July 16, 2024 - Critical RCE Vulnerability: log4j - CVE-2021-44228 | Huntress

CVE-2024-20401

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 9.33

Remote Code Execution

Published: July 17, 2024

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

Quotes

• This vulnerability is due to improper implementation of the password-change process
• A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system
• This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. A successful exploit could allow the attacker to replace any file on the underlying file system
• A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device

Headlines

• July 19, 2024 - Cisco fixed a critical flaw in Security Email Gateway that could allow attackers to add root users
• July 18, 2024 - Critical Cisco bug lets hackers add root users on SEG devices
• July 18, 2024 - Critical Cisco bug allows crims to change admin passwords
• July 18, 2024 - Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419)
• July 17, 2024 - Critical Security Flaw in Cisco Secure Email Gateway: CVE-2024-20401

CVE-2024-36401

CRITICAL CVSS 9.80 EPSS Score 94.64 EPSS Percentile 99.28

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 1, 2024

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Vendors Impacted: Geotools, Geoserver, Osgeo

Products Impacted: Geotools, Geoserver

Quotes

• OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions
• Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions
• The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions

Headlines

• July 17, 2024 - CISA: Patch Critical GeoServer GeoTools Bug Now
• July 16, 2024 - CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks
• July 16, 2024 - CISA adds OSGeo GeoServer GeoTools bug to its Known Exploited Vulnerabilities catalog
• July 16, 2024 - CISA Warns of Actively Exploited RCE Flaw in GeoServer GeoTools Software
• July 15, 2024 - CVE-2024-36401 (CVSS 9.8): Critical GeoServer Flaw Under Active Attack, PoC Available

CVE-2024-34102

CRITICAL CVSS 9.80 EPSS Score 97.32 EPSS Percentile 99.89

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: June 13, 2024

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Vendor Impacted: Adobe

Products Impacted: Commerce Webhooks, Magento, Commerce, Commerce And Magento Open Source

Quotes

• This vulnerability is due to improper implementation of the password-change process

Headlines

• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - CISA Adds Three New Vulnerabilities to Known Exploited Vulnerabilities Catalog
• July 16, 2024 - Critical Magento Flaw Exploited: CosmicSting (CVE-2024-34102) Strikes Global Brands

CVE-2024-4577

CRITICAL CVSS 9.80 EPSS Score 96.75 EPSS Percentile 99.69

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: June 9, 2024

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Vendors Impacted: Php, Php Group, Fedoraproject

Products Impacted: Php, Fedora

Headlines

• July 15, 2024 - Mitel Issues Critical Security Advisory for PHP Argument Injection Vulnerability
• July 14, 2024 - Malware Newsletter - Round 2

CVE-2024-27198

CRITICAL CVSS 9.80 EPSS Score 97.16 EPSS Percentile 99.83

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: March 4, 2024

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Vendor Impacted: Jetbrains

Product Impacted: Teamcity

Quotes

• The speed of exploitation of disclosed CVEs is often quicker than the speed at which humans can create WAF rules or create and deploy patches to mitigate attacks

Headlines

• July 16, 2024 - Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer
• July 13, 2024 - Hackers use PoC exploits in attacks 22 minutes after release

CVE-2021-40444

HIGH CVSS 8.80 EPSS Score 96.91 EPSS Percentile 99.74

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 15, 2021

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.

An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability.

UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Sec...
Please see the NVD entry for the full description.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022, Windows Server 2012, Windows Server 2019, Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2008, Windows Rt 8.1, Mshtml

Quotes

• This zero-day attack is a prime example of how unsupported Windows relics are an overlooked attack surface that can still be exploited by threat actors to infect unsuspecting users with ransomware, backdoors, or as a conduit for other kinds of malware

Headlines

• July 17, 2024 - Void Banshee exploits CVE-2024-38112 zero-day to spread malware
• July 16, 2024 - Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer

CVE-2024-38112

HIGH CVSS 7.50 EPSS Score 1.61 EPSS Percentile 87.60

CISA Known Exploited Actively Exploited Remote Code Execution

Published: July 9, 2024

Windows MSHTML Platform Spoofing Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022, Windows 11 22h2, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2008, Windows 10 1607, Windows 10 22h2, Windows 11 23h2, Windows Server 2022 23h2, Windows 10 1809, Windows 10 1507, Windows, Windows 10 21h2, Windows 11 21h2

Quotes

• Historically been a vast attack surface but now receives no further updates or security fixes
• They're saying what we reported was a defense-in-depth fix only, but they won't tell us what that defense-in-depth fix really is
• Since services such as IE have a large attack surface and no longer receive patches, it represents a serious security concern to Windows users
• Variations of the Atlantida campaign have been highly active throughout 2024 and have evolved to use CVE-2024-38112 as part of Void Banshee infection chains
• This zero-day attack is a prime example of how unsupported Windows relics are an overlooked attack surface that can still be exploited by threat actors to infect unsuspecting users with ransomware, backdoors, or as a conduit for other kinds of malware
• CVD doesn’t work if the only ones coordinating are the researchers. While these are Microsoft examples, there are multiple occasions from various vendors where ‘coordination’ simply means ‘You tell us everything you know about this bug, and maybe something will happen
• The threat actor leveraged CVE-2024-38112 to execute malicious code by abusing the MHTML protocol handler and x-usc directives through internet shortcut (URL) files. Using this technique, the threat actor was able to access and run files directly through the disabled Internet Explorer instance on Windows machines

Headlines

• July 18, 2024 - It's best to just assume you’ve been involved in a data breach somehow
• July 17, 2024 - Void Banshee exploits CVE-2024-38112 zero-day to spread malware
• July 16, 2024 - MHTML Exploited By APT Group Void Banshee
• July 16, 2024 - Void Banshee APT Exploits Microsoft Zero-Day in Spear-Phishing Attacks
• July 16, 2024 - Void Banshee APT exploited "lingering Windows relic" in zero-day attacks
• July 16, 2024 - Zero-day vulnerability in Internet Explorer
• July 16, 2024 - Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer
• July 15, 2024 - ZDI shames Microsoft for coordinated vuln disclosure snafu
• July 14, 2024 - Malware Newsletter - Round 2
• July 14, 2024 - Week in review: RADIUS protocol critical vuln, Microsoft 0-day exploited for a year, AT&T breach

CVE-2024-28995

HIGH CVSS 7.50 EPSS Score 96.00 EPSS Percentile 99.51

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 6, 2024

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Vendor Impacted: Solarwinds

Product Impacted: Serv-U

Quotes

• This vulnerability is due to improper implementation of the password-change process
• These do not plausibly plead actionable deficiencies in the company's reporting of the cybersecurity hack

Headlines

• July 19, 2024 - SolarWinds Patches 11 Critical Flaws in Access Rights Manager Software
• July 18, 2024 - Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
• July 17, 2024 - CISA Adds Three New Vulnerabilities to Known Exploited Vulnerabilities Catalog