Weekly Threat & Vulnerabilities Report

Privilege Escalation

CISA-KEV

OSS

Zero Day

High

Affected Product

Windows Hyper-V

Exploited-in-Wild

CISA Adds three known Exploited Vulnerabilities to Catalog

CVSS Score

7.8

EPSS Score

0.00051

CVE-2024-23692

Template Injection

CISA-KEV

OSS

Zero Day

Critical

Affected Product

Rejetto HTTP File Server

Exploited-in-Wild

CISA Adds three known Exploited Vulnerabilities to Catalog

CVSS Score

9.8

EPSS Score

0.95432

CVE-2024-38112

Spoofing vulnerability

CISA-KEV

OSS

Zero Day

High

Affected Product

Microsoft Windows MSHTML Platform

Exploited-in-Wild

CISA Adds three known Exploited Vulnerabilities to Catalog

CVSS Score

8.1

EPSS Score

0.01649

CVE-2024-29510

Format String vulnerability

CISA-KEV

OSS

Zero Day

Medium

Affected Product

Artifex Ghostscript

Exploited-in-Wild

Artifex Ghostscript

CVSS Score

6.3

EPSS Score

0.00129

CVE-2024-5441

Arbitrary File Upload

CISA-KEV

OSS

Zero Day

High

Affected Product

Modern Events Calendar plugin

Exploited-in-Wild

Modern Events Calendar plugin

CVSS Score

8.8

EPSS Score

0.0005

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2023-49103

CISA-KEV

Critical

Information DisclosureVulnerability in ownCloud graphapi.

Affected Products

ownCloud graphapi

Exploited-in-Wild

ownCloud graphapi

CVE-2023-22527

CISA-KEV

Critical

Template injection vulnerability in Out-of-DateVersions of Confluence Data Center and Server leads to remote code execution

Affected Products

Confluence Data Center and Server

Exploited-in-Wild

Confluence Data Center and Server

CVE-2023-38646

CISA-KEV

Critical

Remote code execution vulnerability in Metabaseopen source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1.

Affected Products

Metabase open source/Enterprise

Exploited-in-Wild

Metabase open source/Enterprise

CVE-2023-33010

CISA-KEV

Critical

Buffer overflow vulnerability in the ID processingfunction in Zyxel ATP series firmware versions leads to denial of service orremote code execution on affected device

Affected Products

Zyxel ATP series firmware

Exploited-in-Wild

Zyxel ATP series firmware

CVE-2023-26801

CISA-KEV

Critical

Command injection vulnerability in LB-LINK devices.

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

CVE-2023-1389

CISA-KEV

High

Command Injection Vulnerability in TP-Link ArcherAX-21.

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX-21

CVE-2022-41040

CISA-KEV

High

Server-Side Request Forgery Vulnerability inMicrosoft Exchange Server

Affected Products

Microsoft Exchange Server

Exploited-in-Wild

Microsoft Exchange Server

CVE-2022-34045

CISA-KEV

Critical

Hardcoded encryption/decryption key vulnerabilityin Wavlink

Affected Products

Wavlink Devices

Exploited-in-Wild

False

CVE-2022-30489

CISA-KEV

Medium

cross-site scripting vulnerability in WavlinkDevices

Affected Products

Wavlink Devices

Exploited-in-Wild

False

CVE-2022-30023

CISA-KEV

High

Command injection vulnerability via the Pingfunction in Tenda Products

Affected Products

Tenda Devices

Exploited-in-Wild

False

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2023-26801

Command injection vulnerability in LB-LINKBL-AC1900_2.0 1.0.1, BL-WR9000 2.4.9, BL-X26 1.2.5 and BL-LTE300 1.0.8

Affected Product

LB-LINK BL Devices

Exploit

Command injection vulnerability in LB-LINKBL-AC1900_2.0 1.0.1, BL-WR9000 2.4.9, BL-X26 1.2.5 and BL-LTE300 1.0.8

Abused by Botnet

CVE-2021-41773

Path traversal vulnerability in Apache HTTP Server

Affected Product

Apache HTTP Server

Exploit

Path traversal vulnerability in Apache HTTP Server

Abused by Botnet

Zerobot

CVE-2017-17215

Remote code execution vulnerability in Huawei HG532router

Affected Product

Huawei HG532

Exploit

Remote code execution vulnerability in Huawei HG532router

Abused by Botnet

Sysrvbotnet

CVE-2017-9841

Arbitrary PHP code execution vulnerability inUtil/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3

Affected Product

Util/PHP/eval-stdin.php in PHPUni

Exploit

Arbitrary PHP code execution vulnerability inUtil/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3

Abused by Botnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2024-21412

High

Security Feature Bypass vulnerability in MicrosoftInternet Shortcut Files

Patch

Security Feature Bypass vulnerability in MicrosoftInternet Shortcut Files

Targeted by Malware

‍

CVE-2023-27532

High

Missing authentication vulnerability in VeeamBackup & Replication component

Patch

Missing authentication vulnerability in VeeamBackup & Replication component

Targeted by Malware

Estate Ransomware

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2024-23967

Stack-based Buffer Overflow

Affected Product

Autel MaxiCharger AC Elite Business C50

Reference

Autel MaxiCharger AC Elite Business C50

CVE-2024-23960

Improper Verification of Cryptographic Signature

Affected Product

Alpine Halo9

Reference

Alpine Halo9