VULNERA Pulse

Veeam — Backup & Replication

CVE-2024-40711 / Added: Oct. 17, 2024

CRITICAL CVSS 9.80 EPSS Score 1.85 EPSS Percentile 88.65

Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.

Headlines

• Oct. 14, 2024 - Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware
• Oct. 12, 2024 - Ransomware operators exploited Veeam Backup & Replication flaw CVE-2024-40711 in recent attacks
• Oct. 11, 2024 - NHS England Warns of Critical Veeam Vulnerability Under Active Exploit
• Oct. 11, 2024 - Fog & Akira Ransomware Exploit Critical Veeam RCE Flaw CVE-2024-40711 After PoC Release
• Oct. 10, 2024 - Akira and Fog ransomware now exploit critical Veeam RCE flaw
• Sept. 19, 2024 - 1 PoC Exploit for RCE Flaw, but 2 Patches From Veeam
• Sept. 18, 2024 - PoC Exploit Releases for Unauthenticated RCE CVE-2024-40711 in Veeam Backup & Replication
• Sept. 15, 2024 - Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days
• Sept. 9, 2024 - Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711)
• Sept. 5, 2024 - Veeam fixed a critical flaw in Veeam Backup & Replication software
• Sept. 5, 2024 - Veeam warns of critical RCE flaw in Backup & Replication software
• Sept. 5, 2024 - Veeam Backup & Replication Faces RCE Flaw– CVE-2024-40711 (CVSS 9.8) Allows Full System Takeover

Back to top ↑

Mozilla — Firefox

CVE-2024-9680 / Added: Oct. 15, 2024

CRITICAL CVSS 9.80 EPSS Score 1.64 EPSS Percentile 87.90

Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.

Headlines

• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day
• Oct. 13, 2024 - Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools
• Oct. 10, 2024 - Critical Mozilla Firefox Zero-Day Allows Code Execution
• Oct. 10, 2024 - A Vulnerability in Mozilla Firefox Could Allow for Arbitrary Code Execution
• Oct. 10, 2024 - Actively exploited Firefox zero-day fixed, update ASAP! (CVE-2024-9680)
• Oct. 10, 2024 - Mozilla releases patches for actively exploited Firefox bug
• Oct. 10, 2024 - Mozilla issued an urgent Firefox update to fix actively exploited flaw
• Oct. 10, 2024 - Firefox Zero-Day Under Attack: Update Your Browser Immediately
• Oct. 9, 2024 - Mozilla fixes Firefox zero-day actively exploited in attacks
• Oct. 9, 2024 - Firefox Zero-Day Vulnerability: Urgent Update Needed to Patch CVE-2024-9680

Back to top ↑

SolarWinds — Web Help Desk

CVE-2024-28987 / Added: Oct. 15, 2024

CRITICAL CVSS 9.10 EPSS Score 96.02 EPSS Percentile 99.53

SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.

Headlines

• Oct. 18, 2024 - SolarWinds Web Help Desk Hit With Critical RCE Flaw (CVE-2024-28988, CVSS 9.8)
• Oct. 16, 2024 - SolarWinds hardcoded credential bug exploited
• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 16, 2024 - CISA Warns of Active Exploitation in SolarWinds Help Desk Software Vulnerability
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day
• Sept. 30, 2024 - Critical SolarWinds Flaw Exposes 827 Instances: PoC Exploit Unveiled for CVE-2024-28987
• Sept. 29, 2024 - Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released
• Sept. 25, 2024 - PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987)
• Aug. 25, 2024 - Week in review: PostgreSQL databases under attack, new Chrome zero-day actively exploited
• Aug. 23, 2024 - Patch Now: Second SolarWinds Critical Bug in Web Help Desk
• Aug. 23, 2024 - Another critical SolarWinds Web Help Desk bug fixed (CVE-2024-28987)
• Aug. 22, 2024 - SolarWinds left hardcoded credentials in helpdesk product
• Aug. 22, 2024 - SolarWinds fixed hardcoded credential issue in Web Help Desk
• Aug. 22, 2024 - Hardcoded Credential Vulnerability Found in SolarWinds Web Help Desk
• Aug. 22, 2024 - SolarWinds fixes hardcoded credentials flaw in Web Help Desk
• Aug. 22, 2024 - SolarWinds Web Help Desk Hit by Critical Vulnerability (CVE-2024-28987)

Back to top ↑

Microsoft — Windows

CVE-2024-30088 / Added: Oct. 15, 2024

HIGH CVSS 7.00 EPSS Score 0.42 EPSS Percentile 74.72

Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.

Headlines

• Oct. 17, 2024 - Iran's APT34 Abuses MS Exchange
• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day
• Oct. 15, 2024 - Earth Simnavaz Exploits Windows Kernel Flaw CVE-2024-30088 in Attacks on Critical Infrastructure
• Oct. 13, 2024 - Iranian hackers now exploit Windows flaw to elevate privileges
• Oct. 13, 2024 - OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
• June 26, 2024 - PoC Exploit Published for Windows Kernel Elevation of Privilege Vulnerability (CVE-2024-30088)
• June 11, 2024 - Only one critical issue disclosed as part of Microsoft Patch Tuesday

Back to top ↑

CVE-2024-9486

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 16.43

Risk Context N/A

Published: Oct. 15, 2024

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Quotes

• To reach the VM where the image build was happening and use the vulnerability to modify the image at the time the image build was occurring
• Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials
• A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Additionally, virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials

Headlines

• Oct. 17, 2024 - A critical flaw in Kubernetes Image Builder could allow attackers to gain root access
• Oct. 17, 2024 - Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk
• Oct. 16, 2024 - Critical Kubernetes Image Builder bug allows SSH root access
• Oct. 16, 2024 - Critical Kubernetes Image Builder flaw gives SSH root access to VMs
• Oct. 16, 2024 - CVE-2024-9486 (CVSS 9.8): Kubernetes Image Builder Flaw Exposes VMs to Root Access

CVE-2024-9680

CRITICAL CVSS 9.80 EPSS Score 1.64 EPSS Percentile 87.90

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 9, 2024

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Vendor Impacted: Mozilla

Products Impacted: Firefox Esr, Firefox, Thunderbird

Quotes

• The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data

Headlines

• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day
• Oct. 13, 2024 - Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools

CVE-2024-28987

CRITICAL CVSS 9.10 EPSS Score 96.02 EPSS Percentile 99.53

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Aug. 21, 2024

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Vendor Impacted: Solarwinds

Product Impacted: Web Help Desk

Quotes

• SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data
• We have seen no threat activity against patched instances and encourage all customers to update SolarWInds Web Help Desk (WHD) 12.8.3 HF1 and all previous versions to 12.8.3 HF2
• The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data
• SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine

Headlines

• Oct. 18, 2024 - SolarWinds Web Help Desk Hit With Critical RCE Flaw (CVE-2024-28988, CVSS 9.8)
• Oct. 16, 2024 - SolarWinds hardcoded credential bug exploited
• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 16, 2024 - CISA Warns of Active Exploitation in SolarWinds Help Desk Software Vulnerability
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day

CVE-2024-8963

CRITICAL CVSS 9.10 EPSS Score 30.99 EPSS Percentile 97.05

CISA Known Exploited

Published: Sept. 19, 2024

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

Vendor Impacted: Ivanti

Products Impacted: Cloud Services Appliance (Csa), Endpoint Manager Cloud Services Appliance

Quotes

• The advanced adversaries were observed exploiting and chaining zero-day vulnerabilities to establish beachhead access in the victim's network
• We are aware of a limited number of customers running CSA 4.6 patch 518 and prior who have been exploited when CVE-2024-9379, CVE-2024-9380 or CVE-2024-9381 are chained with CVE-2024-8963
• The threat actor sent a malformed URL to the resource /client/index.php, by inserting %3F.php at the end of the URI, and appended the URL with the location of the php resource to be accessed through path traversal

Headlines

• Oct. 14, 2024 - Serious Adversaries Circle Ivanti CSA Zero-Day Flaws
• Oct. 14, 2024 - U.S. CISA adds Fortinet products and Ivanti CSA bugs to its Known Exploited Vulnerabilities catalog
• Oct. 13, 2024 - Suspected Nation-State Adversary Exploits Ivanti CSA in a Series of Sophisticated Attacks

CVE-2017-11882

HIGH CVSS 7.80 EPSS Score 97.44 EPSS Percentile 99.96

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Nov. 15, 2017

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

Vendor Impacted: Microsoft

Product Impacted: Office

Quotes

• An advanced modular implant designed specifically for espionage activities
• The group may be perceived as a low-skilled actor due to the use of public exploits, malicious LNK files and scripts as infection vectors, and the use of public RATs, but their true capabilities only become apparent when you carefully examine the details of their operations

Headlines

• Oct. 17, 2024 - SideWinder APT Strikes Middle East and Africa With Stealthy Multi-Stage Attack
• Oct. 16, 2024 - Sidewinder Casts Wide Geographic Net in Latest Attack Spree
• Oct. 16, 2024 - SideWinder APT: A Decade of Evolution and Global Expansion
• Oct. 15, 2024 - SideWinder APT’s post-exploitation framework analysis

CVE-2024-8190

HIGH CVSS 7.20 EPSS Score 15.12 EPSS Percentile 95.95

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 10, 2024

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

Vendor Impacted: Ivanti

Product Impacted: Cloud Services Appliance

Quotes

• The advanced adversaries were observed exploiting and chaining zero-day vulnerabilities to establish beachhead access in the victim's network
• The threat actor sent a malformed URL to the resource /client/index.php, by inserting %3F.php at the end of the URI, and appended the URL with the location of the php resource to be accessed through path traversal
• An advanced adversary was observed exploiting three vulnerabilities affecting the Ivanti Cloud Services Appliance (CSA). At the time of our investigation, two out of the three identified vulnerabilities were not publicly known. This incident is a prime example of how threat actors chain zero-day vulnerabilities to gain initial access to a victim’s network

Headlines

• Oct. 14, 2024 - Serious Adversaries Circle Ivanti CSA Zero-Day Flaws
• Oct. 14, 2024 - Nation-state actor exploited three Ivanti CSA zero-days
• Oct. 14, 2024 - Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration
• Oct. 13, 2024 - Suspected Nation-State Adversary Exploits Ivanti CSA in a Series of Sophisticated Attacks

CVE-2024-9380

HIGH CVSS 7.20 EPSS Score 4.64 EPSS Percentile 92.76

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: Oct. 8, 2024

An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

Vendor Impacted: Ivanti

Products Impacted: Cloud Services Appliance (Csa), Endpoint Manager Cloud Services Appliance

Quotes

• The advanced adversaries were observed exploiting and chaining zero-day vulnerabilities to establish beachhead access in the victim's network
• We are aware of a limited number of customers running CSA 4.6 patch 518 and prior who have been exploited when CVE-2024-9379, CVE-2024-9380 or CVE-2024-9381 are chained with CVE-2024-8963

Headlines

• Oct. 14, 2024 - Serious Adversaries Circle Ivanti CSA Zero-Day Flaws
• Oct. 14, 2024 - U.S. CISA adds Fortinet products and Ivanti CSA bugs to its Known Exploited Vulnerabilities catalog
• Oct. 13, 2024 - Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools

CVE-2024-30088

HIGH CVSS 7.00 EPSS Score 0.42 EPSS Percentile 74.72

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 11, 2024

Windows Kernel Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 22h2, Windows Server 2022, Windows Server 2019, Windows 10 21h2, Windows Server 2022 23h2, Windows Server 2016, Windows 10 1809, Windows 11 22h2, Windows 10 1607, Windows , Windows 11 23h2, Windows 11 21h2, Windows 10 1507

Quotes

• Earth Simnavaz is focused on abusing vulnerabilities in key infrastructure of geopolitically sensitive regions
• The key objective of this stage is to capture the stolen passwords and transmit them to the attackers as email attachments
• The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data
• One of the most impressive feats we've observed from APT34 is their skill in crafting and fine-tuning stealthy exfiltration channels that allow them to steal data from high profile sensitive networks
• The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for credentials theft, and exploiting vulnerabilities like CVE-2024-30088 for privilege escalation

Headlines

• Oct. 17, 2024 - Iran's APT34 Abuses MS Exchange
• Oct. 16, 2024 - SolarWinds Web Help Desk flaw is now exploited in attacks
• Oct. 16, 2024 - U.S. CISA adds Microsoft Windows Kernel, Mozilla Firefox and SolarWinds Web Help Desk bugs to its Known Exploited Vulnerabilities catalog
• Oct. 15, 2024 - CISA Warns Actively Exploited Vulnerabilities, Including Windows Kernel Flaw and Firefox Zero-Day
• Oct. 15, 2024 - Earth Simnavaz Exploits Windows Kernel Flaw CVE-2024-30088 in Attacks on Critical Infrastructure
• Oct. 13, 2024 - Iranian hackers now exploit Windows flaw to elevate privileges
• Oct. 13, 2024 - OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf

CVE-2024-9594

MEDIUM CVSS 6.30 EPSS Score 0.04 EPSS Percentile 16.43

Risk Context N/A

Published: Oct. 15, 2024

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

Quotes

• To reach the VM where the image build was happening and use the vulnerability to modify the image at the time the image build was occurring
• Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials
• A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Additionally, virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials

Headlines

• Oct. 17, 2024 - A critical flaw in Kubernetes Image Builder could allow attackers to gain root access
• Oct. 17, 2024 - Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk
• Oct. 16, 2024 - Critical Kubernetes Image Builder bug allows SSH root access
• Oct. 16, 2024 - Critical Kubernetes Image Builder flaw gives SSH root access to VMs
• Oct. 16, 2024 - CVE-2024-9486 (CVSS 9.8): Kubernetes Image Builder Flaw Exposes VMs to Root Access

CVE-2024-44133

MEDIUM CVSS 5.50 EPSS Score 0.04 EPSS Percentile 9.69

Actively Exploited Remote Code Execution

Published: Sept. 17, 2024

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devices, an app may be able to bypass certain Privacy preferences.

Vendor Impacted: Apple

Product Impacted: Macos

Quotes

• The vulnerability, which we refer to as
• Reading arbitrary files from the directory allows attackers to gather extremely useful information
• Involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user's data, including browsed pages, the device's camera, microphone, and location, without the user's consent
• Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the Adload campaign is exploiting the HM Surf vulnerability itself. Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique

Headlines

• Oct. 18, 2024 - macOS Vulnerability Could Expose User Data, Microsoft Warns
• Oct. 18, 2024 - macOS HM Surf flaw in TCC allows bypass Safari privacy settings
• Oct. 18, 2024 - Microsoft Reveals macOS Vulnerability that Bypasses Privacy Controls in Safari Browser
• Oct. 17, 2024 - HM Surf (CVE-2024-44133): macOS Flaw Exposing Cameras and Microphones to Hackers, PoC Published