Snapshot
Nov. 16, 2024 - Nov. 22, 2024
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2024-38813 | VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. | CRITICAL | VMware | Nov. 20, 2024 |
| CVE-2024-38812 | VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. | CRITICAL | VMware | Nov. 20, 2024 |
| CVE-2024-1212 | Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. | CRITICAL | Progress | Nov. 18, 2024 |
| CVE-2024-0012 | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. | CRITICAL | Palo Alto Networks | Nov. 18, 2024 |
| CVE-2024-9474 | Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. | HIGH | Palo Alto Networks | Nov. 18, 2024 |
Newswires |
||||
|
Apple Patches Two Zero-Day Vulnerabilities in Intel-Based Macs
Apple has urgently released security patches to rectify two zero-day vulnerabilities that have been used in attacks on Intel-based Mac systems. |
Nov. 19, 2024 |
|||
|
CISA Identifies Actively Exploited Vulnerability in Progress Kemp LoadMaster
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has included three new vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog. |
Nov. 19, 2024 |
|||
|
Oracle Addresses Zero-Day Exploit in Agile PLM Software
Oracle has recently remedied an unauthenticated file disclosure vulnerability in its Oracle Agile Product Lifecycle Management (PLM) software, which was being actively exploited in the wild. |
Nov. 19, 2024 |
|||
|
D-Link Urges Users to Replace VPN Routers Due to Unresolved RCE Vulnerability
D-Link, the networking hardware vendor, has alerted its customers about a critical unauthenticated, remote code execution vulnerability affecting certain end-of-life VPN router models. |
Nov. 19, 2024 |
|||
|
Helldown Ransomware Targets Zyxel VPN Vulnerability to Infiltrate Networks
The 'Helldown' ransomware operation is believed to be exploiting vulnerabilities in Zyxel firewalls to infiltrate corporate networks, steal data, and encrypt devices. |
Nov. 19, 2024 |
|||
|
VMware vCenter Server Vulnerabilities Now Under Active Exploitation
Broadcom has issued a warning about the active exploitation of two vulnerabilities in VMware vCenter Server. |
Nov. 18, 2024 |
|||
|
Palo Alto Networks Addresses Four Critical Security Flaws in Expedition Firewall
Palo Alto Networks (PAN) warned its customers of a critical, unauthenticated remote code execution (RCE) bug actively exploited by cybercriminals in its Expedition firewall interface. |
Nov. 18, 2024 |
|||
|
NSO Group Continued Exploiting WhatsApp to Deliver Pegasus Spyware Post Meta Lawsuit
Legal documents recently made public amid the ongoing legal battle between WhatsApp, owned by Meta, and NSO Group, an Israeli spyware manufacturer, reveal that the latter continued to use various exploits to deliver its Pegasus spyware via WhatsApp, even after Meta had initiated legal action against it. |
Nov. 18, 2024 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2024-0012 (9) | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the... | CRITICAL | Paloaltonetworks, Palo Alto Networks |
CISA Known Exploited Actively Exploited Public Exploits Available |
| CVE-2024-38813 (5) | The vCenter Server contains a privilege escalation vulnerability. | CRITICAL | Vmware |
CISA Known Exploited |
| CVE-2024-38812 (5) | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. | CRITICAL | Vmware |
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
| CVE-2024-10924 (4) | The Really Simple Security plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. | CRITICAL | Really-Simple-Plugins |
Remote Code Execution Public Exploits Available |
| CVE-2024-9465 (4) | An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition datab... | CRITICAL | Paloaltonetworks, Palo Alto Networks |
CISA Known Exploited Public Exploits Available |
| CVE-2024-44308 (8) | The issue was addressed with improved checks. | HIGH | Risk Context N/A | |
| CVE-2024-9463 (4) | An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS... | HIGH | Paloaltonetworks, Palo Alto Networks |
CISA Known Exploited Public Exploits Available |
| CVE-2024-9474 (9) | A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the m... | HIGH | Paloaltonetworks, Palo Alto Networks |
CISA Known Exploited Actively Exploited Public Exploits Available |
| CVE-2024-43451 (4) | NTLM Hash Disclosure Spoofing Vulnerability | MEDIUM | Microsoft |
CISA Known Exploited Actively Exploited Remote Code Execution |
| CVE-2024-44309 (8) | A cookie management issue was addressed with improved state management. | N/A | Risk Context N/A | |
CISA Known Exploited Vulnerabilities
CISA added five vulnerabilities to the known exploited vulnerabilities list.
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2024-0012 |
|
CRITICAL CVSS 9.80 EPSS Score 96.61 EPSS Percentile 99.68 |
|
CISA Known Exploited Actively Exploited Public Exploits Available |
|
Published: Nov. 18, 2024 |
|
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability. |
|
Vendors Impacted: Paloaltonetworks, Palo Alto Networks |
|
Product Impacted: Pan-Os |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38813 |
|
CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 41.11 |
|
CISA Known Exploited |
|
Published: Sept. 17, 2024 |
|
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet. |
|
Vendor Impacted: Vmware |
|
Product Impacted: Vcenter Server |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-38812 |
|
CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 41.11 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: Sept. 17, 2024 |
|
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. |
|
Vendor Impacted: Vmware |
|
Product Impacted: Vcenter Server |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-10924 |
|
CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 11.63 |
|
Remote Code Execution Public Exploits Available |
|
Published: Nov. 15, 2024 |
|
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default). |
|
Vendor Impacted: Really-Simple-Plugins |
|
Product Impacted: Really Simple Security |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-9465 |
|
CRITICAL CVSS 9.10 EPSS Score 94.95 EPSS Percentile 99.38 |
|
CISA Known Exploited Public Exploits Available |
|
Published: Oct. 9, 2024 |
|
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. |
|
Vendors Impacted: Paloaltonetworks, Palo Alto Networks |
|
Product Impacted: Expedition |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-44308 |
|
HIGH CVSS 8.80 EPSS Score 0.04 EPSS Percentile 17.04 |
|
Risk Context N/A |
|
Published: Nov. 20, 2024 |
|
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-9463 |
|
HIGH CVSS 7.50 EPSS Score 96.23 EPSS Percentile 99.58 |
|
CISA Known Exploited Public Exploits Available |
|
Published: Oct. 9, 2024 |
|
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. |
|
Vendors Impacted: Paloaltonetworks, Palo Alto Networks |
|
Product Impacted: Expedition |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-9474 |
|
HIGH CVSS 7.20 EPSS Score 97.40 EPSS Percentile 99.94 |
|
CISA Known Exploited Actively Exploited Public Exploits Available |
|
Published: Nov. 18, 2024 |
|
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability. |
|
Vendors Impacted: Paloaltonetworks, Palo Alto Networks |
|
Product Impacted: Pan-Os |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-43451 |
|
MEDIUM CVSS 6.50 EPSS Score 0.47 EPSS Percentile 76.23 |
|
CISA Known Exploited Actively Exploited Remote Code Execution |
|
Published: Nov. 12, 2024 |
|
NTLM Hash Disclosure Spoofing Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows 10 1809, Windows 10 22h2, Windows 11 23h2, Windows 11 22h2, Windows Server 2025, Windows Server 2016, Windows 10 1507, Windows Server 2008, Windows Server 2012, Windows Server 2019, Windows 10 1607, Windows, Windows Server 2022, Windows 11 24h2, Windows Server 2022 23h2, Windows 10 21h2 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-44309 |
|
CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 17.04 |
|
Risk Context N/A |
|
Published: Nov. 20, 2024 |
|
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
