VULNERA Pulse

GitLab — GitLab CE/EE

CVE-2023-7028 / Added: May 1, 2024

HIGH CVSS 7.50 EPSS Score 95.38 EPSS Percentile 99.34

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

Headlines

• May 3, 2024 - Critical GitLab Bug Under Exploit Enables Account Takeover, CISA Warns
• May 2, 2024 - Federal frenzy to patch gaping security hole in GitLab
• May 2, 2024 - 1,400 GitLab Servers Impacted by Exploited Vulnerability
• May 2, 2024 - CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog
• May 2, 2024 - CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability
• May 1, 2024 - CISA says GitLab account takeover bug is actively exploited in attacks
• Jan. 30, 2024 - URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite
• Jan. 26, 2024 - CVE-2024-0402: GitLab Releases Urgent Security Patches for Critical Vulnerability
• Jan. 25, 2024 - Thousands of GitLab Instances Unpatched Against Critical Password Reset Bug
• Jan. 24, 2024 - 5379 GitLab servers vulnerable to zero-click account takeover attacks
• Jan. 24, 2024 - Over 5,300 GitLab servers exposed to zero-click account takeover attacks
• Jan. 15, 2024 - GitLab fixes account takeover vulnerability
• Jan. 15, 2024 - 2FA-less GitLab users vulnerable to account takeovers
• Jan. 14, 2024 - Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days
• Jan. 13, 2024 - GitLab fixed a critical zero-click account hijacking flaw
• Jan. 12, 2024 - GitLab Releases Updates to Address Critical Vulnerabilities
• Jan. 12, 2024 - GitLab warns of critical zero-click account hijacking vulnerability
• Jan. 12, 2024 - Urgent: GitLab Releases Patch for Critical Vulnerabilities - Update ASAP
• Jan. 12, 2024 - Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)
• Jan. 12, 2024 - CVE-2023-7028 & 5356: GitLab Addresses Account Takeover & Command Flaws

Back to top ↑

Microsoft — SmartScreen Prompt

CVE-2024-29988 / Added: April 30, 2024

HIGH CVSS 8.80 EPSS Score 0.46 EPSS Percentile 75.09

Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.

Headlines

• May 1, 2024 - CISA Catalogs Microsoft's CVE-2024-29988 as Actively Exploited Vulnerability
• April 14, 2024 - Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
• April 11, 2024 - One of Microsoft’s biggest Windows 11 updates yet brought a massive number of security flaw fixes
• April 11, 2024 - Microsoft fixed two zero-day flaws exploited in malware attacks
• April 10, 2024 - Microsoft unleashes 157 bug fixes
• April 10, 2024 - Microsoft Patches Tuesday security updates for April 2024 fixed hundreds of issues
• April 10, 2024 - Microsoft Patches Tuesday security updates for April 2024 fixed hundreds of issues
• April 10, 2024 - Microsoft Patches 150 Flaws Including Two Zero-Days
• April 10, 2024 - Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included
• April 10, 2024 - Microsoft security bypass bug said to be under exploit
• April 9, 2024 - Microsoft fixes two Windows zero-days exploited in malware attacks
• April 9, 2024 - Microsoft Patch Tuesday Tsunami: No Zero-Days, but an Asterisk
• April 9, 2024 - April’s Patch Tuesday Brings Record Number of Fixes –
• April 9, 2024 - CVE-2024-29988: 'In-the-Wild' Flaw Among Microsoft's April 2024 Patch Tuesday
• April 9, 2024 - Microsoft patches actively exploited security feature bypass vulnerability (CVE-2024-29988)
• April 9, 2024 - Critical Patches Issued for Microsoft Products, April 09, 2024

Back to top ↑

CVE-2024-4040

CRITICAL CVSS 10.00 EPSS Score 1.60 EPSS Percentile 87.32

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: April 22, 2024

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Vendor Impacted: Crushftp

Product Impacted: Crushftp

Quotes

• Scraping our services and self-botting are violations of our Terms of Service and Community Guidelines. In addition to banning the affiliated accounts, we are considering appropriate legal action

Headlines

• April 29, 2024 - Discord snoop site Spy.pet is offline, banned from platform
• April 28, 2024 - Week in review: Two Cisco ASA zero-days exploited, MITRE breach, GISEC Global 2024

CVE-2024-3400

CRITICAL CVSS 10.00 EPSS Score 95.36 EPSS Percentile 99.34

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: April 12, 2024

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Vendors Impacted: Paloaltonetworks, Palo Alto Networks

Product Impacted: Pan-Os

Quotes

• An investigation of the IP address reveals that it is associated with a known Sysrv Botnet
• Not aware at this time of any malicious attempts to use these persistence techniques in active exploitation of the vulnerability

Headlines

• April 30, 2024 - Palo Alto firewalls: CVE-2024-3400 exploitation and PoCs for persistence after resets/upgrades
• April 29, 2024 - Palo Alto Firewalls Under Attack: Critical Flaw Exploited to Deploy Cryptojacking Malware

CVE-2021-44228

CRITICAL CVSS 10.00 EPSS Score 97.56 EPSS Percentile 100.00

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Sonicwall, Cisco, Siemens, Intel, Apache, Snowsoftware, Bentley, Debian, Netapp, Percussion, Fedoraproject

Products Impacted: Log4j, Log4j2, Siveillance Vantage, Cloud Secure Agent, Virtualized Infrastructure Manager, Fog Director, Siveillance Command, Sentron Powermanager, Dna Spaces\, Nx, Unified Contact Center Express, Wan Automation Engine, Opcenter Intelligence, Virtual Topology System, Rhythmyx, Siveillance Control Pro, Crosswork Data Gateway, Cloud Manager, Emergency Responder, Firepower 9300, Identity Services Engine, Integrated Management Controller Supervisor, Active Iq Unified Manager, Customer Experience Cloud Agent, Secure Device Onboard, Firepower 4110, Crosswork Optimization Engine, Industrial Edge Management Hub, Firepower 4112, Desigo Cc Info Center, Gma-Manager, Synchro 4d, Automated Subsea Tuning, System Studio, Unified Sip Proxy, Unified Workforce Optimization, Cloudcenter Suite Admin, Captial, Common Services Platform Collector, Firepower 2110, Desigo Cc Advanced Reports, Solid Edge Cam Pro, Nexus Insights, Oncommand Insight, Firepower 4125, Unified Communications Manager Im And Presence Service, Finesse,...

Headlines

• May 2, 2024 - LOLBin to INC Ransomware | Huntress
• April 29, 2024 -

CVE-2024-29021

CRITICAL CVSS 9.00 EPSS Score 0.04 EPSS Percentile 8.27

Remote Code Execution

Published: April 18, 2024

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Quotes

• Adversary with sufficient access to perform a sandbox escape and obtain root permissions on the host machine

Headlines

• April 29, 2024 - Judge0 Sandbox Vulnerabilities Expose Systems to Takeover Risk
• April 29, 2024 - Sandbox Escape Vulnerabilities in Judge0 Expose Systems to Complete Takeover

CVE-2024-27322

HIGH CVSS 8.80 EPSS Score 0.04 EPSS Percentile 14.37

Remote Code Execution

Published: April 29, 2024

Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.

Quotes

• Involves the use of promise objects and lazy evaluation in R
• This vulnerability can be exploited through the loading of RDS files or R packages, which are often shared between developers and data scientists
• Our team discovered that it is possible to craft a malicious RDS file that will execute arbitrary code when loaded and referenced. This vulnerability, assigned CVE-2024-27322, involves the use of promise objects and lazy evaluation in R

Headlines

• May 1, 2024 - A flaw in the R programming language could allow code execution
• May 1, 2024 - CERT/CC Reports R Programming Language Vulnerability | CISA
• May 1, 2024 - Programming language R patched for critical ACE vuln
• April 30, 2024 - R language flaw allows code execution via RDS/RDX files
• April 30, 2024 - New R Vulnerability CVE-2024-27322: Code Execution Risk in Data Files
• April 29, 2024 - R Programming Bug Exposes Orgs to Vast Supply Chain Risk
• April 29, 2024 - New R Programming Vulnerability Exposes Projects to Supply Chain Attacks

CVE-2024-1708

HIGH CVSS 8.40 EPSS Score 0.05 EPSS Percentile 17.92

Public Exploits Available

Published: Feb. 21, 2024

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

Vendor Impacted: Connectwise

Product Impacted: Screenconnect

Quotes

• Directory traversal exploits succeed because technology manufacturers fail to treat user supplied content as potentially malicious, hence failing to adequately protect their customers

Headlines

• May 2, 2024 - CISA urges software devs to weed out path traversal vulnerabilities
• May 2, 2024 - CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities | CISA

CVE-2017-8570

HIGH CVSS 7.80 EPSS Score 97.34 EPSS Percentile 99.88

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 11, 2017

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.

Vendor Impacted: Microsoft

Product Impacted: Office

Quotes

• The PPSX (PowerPoint slideshow) file appears to be an old instruction manual of the U.S. Army for mine clearing blades (MCB) for tanks
• The lure contained military-related content, suggesting it was targeting military personnel. But the domain names weavesilk[.]space and petapixel[.]fun are disguised as an obscure generative art site (http://weavesilk.com) and a popular photography site (https://petapixel.com). These are unrelated, and it’s a bit puzzling why an attacker would use these specifically to fool military personnel

Headlines

• April 28, 2024 - Targeted operation against Ukraine exploited 7-year-old MS Office bug
• April 27, 2024 - Ukraine Targeted in Cyberattack Exploiting 7-Year-Old Microsoft Office Flaw

CVE-2023-20963

HIGH CVSS 7.80 EPSS Score 0.22 EPSS Percentile 60.50

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 24, 2023

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

Vendors Impacted: Google, Android

Products Impacted: Framework, Android

Quotes

• Protecting the data security and privacy of our users is the top priority. Xiaomi has remediated all vulnerabilities reported by the Oversecured team and has ensured that no user is exposed to risk posed by these vulnerabilities. Users are always advised to update their devices to the latest version of software which offers security updates

Headlines

• May 2, 2024 - More than two dozen Android vulnerabilities fixed

CVE-2023-7028

HIGH CVSS 7.50 EPSS Score 95.38 EPSS Percentile 99.34

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 12, 2024

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Vendor Impacted: Gitlab

Products Impacted: Gitlab Ce/ee, Gitlab

Quotes

• Within these versions, all authentication mechanisms are impacted
• This will allow attackers to reset the password just as if they were a user that had legitimately forgotten theirs
• These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise
• GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover
• An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address

Headlines

• May 3, 2024 - Critical GitLab Bug Under Exploit Enables Account Takeover, CISA Warns
• May 2, 2024 - Federal frenzy to patch gaping security hole in GitLab
• May 2, 2024 - 1,400 GitLab Servers Impacted by Exploited Vulnerability
• May 2, 2024 - CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog
• May 2, 2024 - CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability
• May 1, 2024 - CISA says GitLab account takeover bug is actively exploited in attacks

CVE-2024-20345

MEDIUM CVSS 6.50 EPSS Score 0.04 EPSS Percentile 8.27

Risk Context N/A

Published: March 6, 2024

A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.

Quotes

• Directory traversal exploits succeed because technology manufacturers fail to treat user supplied content as potentially malicious, hence failing to adequately protect their customers

Headlines

• May 2, 2024 - CISA urges software devs to weed out path traversal vulnerabilities
• May 2, 2024 - CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities | CISA