Vulnerability News - May 17, 2024

Snapshot

May 11, 2024 - May 17, 2024

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2021-40655	D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.	HIGH	D-Link	May 16, 2024
CVE-2014-100005	D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.	MEDIUM	D-Link	May 16, 2024
CVE-2024-4761	Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.	N/A	Google	May 16, 2024
CVE-2024-30040	Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.	HIGH	Microsoft	May 14, 2024
CVE-2024-30051	Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.	HIGH	Microsoft	May 14, 2024
CVE-2024-4671	Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.	CRITICAL	Google	May 13, 2024
Newswires
Microsoft Yet to Address Seven Zero-Days Vulnerabilities Uncovered in Pwn2Own 2024 Microsoft has yet to rectify seven distinct Windows privilege escalation vulnerabilities, which were made public at Pwn2Own 2024 in Vancouver two months ago.				May 17, 2024
CISA Includes Chrome Zero-Days in its Known Exploited Vulnerabilities Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has incorporated two new vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog.				May 17, 2024
Asian Cyber Threats Evolve: New Strategies Target Familiar Sectors Since mid-2023, Microsoft has noted a significant shift in cyber and influence trends emanating from China and North Korea.				May 16, 2024
GE Ultrasound Devices Vulnerable to Ransomware and Data Theft Researchers have unearthed 11 security vulnerabilities in GE HealthCare's Vivid Ultrasound product line, along with two related software programs.				May 16, 2024
Google Responds to Third Chrome Zero-Day Exploit in a Week Google has launched an emergency security update to tackle the third zero-day vulnerability that has been exploited within a week.				May 15, 2024
Ebury Botnet Malware Infects 400,000 Linux Servers Over 14 Years The Ebury botnet malware has been infiltrating Linux servers for the past 14 years, compromising an estimated 400,000 servers since 2009, according to a report from cybersecurity firm ESET.				May 15, 2024
QakBot Malware Attacks Exploiting Windows Zero-Day Vulnerability Addressed by Microsoft Microsoft has addressed a zero-day vulnerability, designated as CVE-2024-30051, that was being exploited to deliver QakBot and other malware on vulnerable Windows systems.				May 14, 2024
Microsoft's May 2024 Patch Tuesday Addresses 61 Vulnerabilities Including 3 Zero-Days Microsoft's May 2024 Patch Tuesday has brought forth updates addressing 61 security flaws, including three zero-days that were either actively exploited or publicly disclosed.				May 14, 2024
Google Scrambles to Patch Chrome Zero-Day Vulnerabilities Allowing Sandbox Escape Google has issued an immediate security update for its Chrome browser to address a zero-day vulnerability, marked as CVE-2024-4761.				May 14, 2024
Apple Patches Safari WebKit Zero-Day Exploit Uncovered at Pwn2Own Apple has rolled out security patches to mend a zero-day flaw in its Safari web browser, which was exploited at the Pwn2Own Vancouver hacking competition this year.				May 14, 2024
VMware Patches Trio of Zero-Day Vulnerabilities Exposed at Pwn2Own 2024 VMware has issued patches for four security vulnerabilities in its Workstation and Fusion desktop hypervisors, three of which were zero-day vulnerabilities revealed during the Pwn2Own Vancouver 2024 hacking contest.				May 14, 2024
Google Chrome Rolls Out Emergency Patch for 6th Zero-Day Exploit of 2024 Google has urgently released security patches for its widely-used Chrome browser to rectify a high-severity zero-day vulnerability, known as CVE-2024-4761, which has been exploited in cyber attacks.				May 14, 2024
Apple Backports Security Patches to Older iPhones and iPads Amid Active Exploitation of Zero-Day Apple has recently applied security patches to older models of iPhones and iPads, addressing a zero-day vulnerability that was reportedly being exploited in targeted attacks.				May 13, 2024
Black Basta Ransomware Group Adopts New Vishing Strategy, Targeting Over 500 Organizations Black Basta, a notorious ransomware group, has reportedly adopted a new vishing (voice phishing) technique to trick its victims.				May 13, 2024
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2024-4671 (18)	Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer...	CRITICAL	Google	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2024-22267 (5)	VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device.	CRITICAL		Risk Context N/A
CVE-2024-30040 (13)	Windows MSHTML Platform Security Feature Bypass Vulnerability	HIGH	Microsoft	CISA Known Exploited
CVE-2024-30051 (18)	Windows DWM Core Library Elevation of Privilege Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited
CVE-2024-23296 (7)	A memory corruption issue was addressed with improved validation.	HIGH	Apple	CISA Known Exploited Remote Code Execution
CVE-2024-30044 (9)	Microsoft SharePoint Server Remote Code Execution Vulnerability	HIGH		Remote Code Execution
CVE-2024-22270 (5)	VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing functionality.	HIGH		Risk Context N/A
CVE-2024-22269 (5)	VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device.	HIGH		Risk Context N/A
CVE-2024-4761 (16)	Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memo...	N/A	Google	CISA Known Exploited Actively Exploited Public Exploits Available
CVE-2024-4947 (10)	Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a san...	N/A		Actively Exploited Remote Code Execution

CISA Known Exploited Vulnerabilities

CISA added six vulnerabilities to the known exploited vulnerabilities list.

D-Link — DIR-605 Router

CVE-2021-40655 / Added: May 16, 2024

HIGH CVSS 7.50 EPSS Score 10.46 EPSS Percentile 94.98

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

Headlines

May 16, 2024 - CISA Alerts on Active Exploitation of Flaws in D-Link Routers and Chromium Browser

D-Link — DIR-600 Router

CVE-2014-100005 / Added: May 16, 2024

MEDIUM CVSS 6.80 EPSS Score 87.85 EPSS Percentile 98.65

D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.

Headlines

Google — Chromium Visuals

CVE-2024-4761 / Added: May 16, 2024

CVSS Not Assigned EPSS Score 4.51 EPSS Percentile 92.44

Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Headlines

Microsoft — Windows

CVE-2024-30040 / Added: May 14, 2024

HIGH CVSS 8.80 EPSS Score 0.94 EPSS Percentile 83.04

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.

Headlines

Microsoft — DWM Core Library

CVE-2024-30051 / Added: May 14, 2024

HIGH CVSS 7.80 EPSS Score 0.05 EPSS Percentile 19.29

Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.

Headlines

Google — Chromium

CVE-2024-4671 / Added: May 13, 2024

CRITICAL CVSS 9.60 EPSS Score 0.88 EPSS Percentile 82.41

Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2024-4671

CRITICAL CVSS 9.60 EPSS Score 0.88 EPSS Percentile 82.41

CISA Known Exploited Actively Exploited Remote Code Execution

Published: May 14, 2024

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Vendor Impacted: Google

Products Impacted: Chromium, Chrome

Quotes

Access to one of the largest cyber security companies
Google is aware that an exploit for CVE-2024-4671 exists in the wild
To manipulate the specially crafted file, but not necessarily click or open the malicious file
Makes it possible to manipulate parts of the memory which are allocated to more critical functions
Proton has minimal user information, as illustrated by the fact that in this case data obtained from Apple was used to identify the terrorism suspect
The Stable channel has been updated to 124.0.6367.201/.202 for Mac and Windows and 124.0.6367.201 for Linux which will roll out over the coming days/weeks
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user

Headlines

CVE-2024-22267

CRITICAL CVSS 9.30 EPSS Score 0.04 EPSS Percentile 8.57

Risk Context N/A

Published: May 14, 2024

VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Quotes

Believe that multiple threat actors have access to it
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host
VMware would like to thank Gwangun Jung (@pr0ln) & Junoh Lee (@bbbig12) of Theori (@theori_io) and STAR Labs SG working with the Pwn2Own 2024 Security Contest for independently reporting this issue to us

Headlines

CVE-2024-30040

HIGH CVSS 8.80 EPSS Score 0.94 EPSS Percentile 83.04

CISA Known Exploited

Published: May 14, 2024

Windows MSHTML Platform Security Feature Bypass Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 1809, Windows Server 2022, Windows 11 22h2, Windows 11 23h2, Windows Server 2016, Windows 10 21h2, Windows 10 1607, Windows 10 22h2, Windows 11 21h2, Windows Server 2019, Windows, Windows 10 1507, Windows Server 2022 23h2

Quotes

Numerous and diverse local users
Publicly known at the time of the release
Believe that multiple threat actors have access to it
These types of bugs are very commonly used by threat actors
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
To manipulate the specially crafted file, but not necessarily click or open the malicious file
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user
An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file

Headlines

CVE-2024-30051

HIGH CVSS 7.80 EPSS Score 0.05 EPSS Percentile 19.29

CISA Known Exploited Actively Exploited

Published: May 14, 2024

Windows DWM Core Library Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Quotes

Numerous and diverse local users
AI is the best thing ever for security
Publicly known at the time of the release
Believe that multiple threat actors have access to it
These types of bugs are very commonly used by threat actors
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
To manipulate the specially crafted file, but not necessarily click or open the malicious file
CVE-2024-30051 is used to gain initial access into a target environment and requires the use of social engineering tactics via email, social media or instant messaging to convince a target to open a specially crafted document file
After sending our findings to Microsoft, we began to closely monitor our statistics in search of exploits and attacks that exploit this zero-day vulnerability, and in mid-April we discovered an exploit for this zero-day vulnerability
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user
An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file

Headlines

CVE-2024-23296

HIGH CVSS 7.80 EPSS Score 0.08 EPSS Percentile 34.77

CISA Known Exploited Remote Code Execution

Published: March 5, 2024

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Vendor Impacted: Apple

Products Impacted: Ipad Os, Multiple Products, Iphone Os

Quotes

May have been actively exploited
Believe that multiple threat actors have access to it
This will help mitigate the misuse of devices designed to help keep track of belongings
An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections
MarketplaceKit now generates a different client_id every time it is called. Now there’s no way for alternative marketplace developers to identify users who have already purchased the marketplace app

Headlines

CVE-2024-30044

HIGH CVSS 7.20 EPSS Score 0.05 EPSS Percentile 18.56

Remote Code Execution

Published: May 14, 2024

Microsoft SharePoint Server Remote Code Execution Vulnerability

Quotes

Numerous and diverse local users
AI is the best thing ever for security
Believe that multiple threat actors have access to it
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
To manipulate the specially crafted file, but not necessarily click or open the malicious file

Headlines

CVE-2024-22270

HIGH CVSS 7.10 EPSS Score 0.04 EPSS Percentile 8.57

Risk Context N/A

Published: May 14, 2024

VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

Quotes

Believe that multiple threat actors have access to it
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host
VMware would like to thank Gwangun Jung (@pr0ln) & Junoh Lee (@bbbig12) of Theori (@theori_io) and STAR Labs SG working with the Pwn2Own 2024 Security Contest for independently reporting this issue to us

Headlines

CVE-2024-22269

HIGH CVSS 7.10 EPSS Score 0.04 EPSS Percentile 8.57

Risk Context N/A

Published: May 14, 2024

VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

Quotes

Believe that multiple threat actors have access to it
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host
VMware would like to thank Gwangun Jung (@pr0ln) & Junoh Lee (@bbbig12) of Theori (@theori_io) and STAR Labs SG working with the Pwn2Own 2024 Security Contest for independently reporting this issue to us

Headlines

CVE-2024-4761

CVSS Not Assigned EPSS Score 4.51 EPSS Percentile 92.44

CISA Known Exploited Actively Exploited Public Exploits Available

Published: May 14, 2024

Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Vendor Impacted: Google

Product Impacted: Chromium Visuals

Quotes

Publicly known at the time of the release
Believe that multiple threat actors have access to it
Google is aware that an exploit for CVE-2024-4761 exists in the wild
CVE-2024-4761: Out of bounds write in V8. Reported by Anonymous on 2024-05-09″ reads the advisory
Makes it possible to manipulate parts of the memory which are allocated to more critical functions
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user

Headlines

CVE-2024-4947

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 8.57

Actively Exploited Remote Code Execution

Published: May 15, 2024

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Quotes

Google is aware that an exploit for CVE-2024-4947 exists in the wild
Successful exploitation of most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

May 17, 2024

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

May 17, 2024

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

D-Link — DIR-605 Router

D-Link — DIR-600 Router

Google — Chromium Visuals

Microsoft — Windows

Microsoft — DWM Core Library

Google — Chromium

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe