Microsoft Patch Tuesday, March 2024 Security Update Review

Welcome to another insightful dive into Microsoft’s Patch Tuesday! This month’s security updates address many CVEs, underscoring the ongoing battle against digital vulnerabilities. We invite you to join us to review and discuss the details of these security updates and patches. Microsoft Patch Tuesday’s March 2024 edition addressed 64 vulnerabilities, including two critical and 58 … Continue reading “Microsoft Patch Tuesday, March 2024 Security Update Review”

VMware Arbitrary Authentication Relay and Session Hijack Vulnerabilities Impacting Deprecated Enhanced Authentication Plug-in (EAP) (CVE-2024-22245 & CVE-2024-22250)

VMware has requested the users to uninstall a deprecated Enhanced Authentication Plug-in (EAP) in response to two vulnerabilities. Tracked as CVE-202402245 and CVE-2024-22250, the vulnerabilities have critical and important severity ratings, respectively. VMware announced the deprecation of the EAP in 2021 with the release of vCenter Server 7.0u2.

Critical ConnectWise ScreenConnect Flaws Patched: Urgent Update Advised

Two vulnerabilities have been identified in ConnectWise’s ScreenConnect software, which is extensively utilized by Managed Service Providers (MSPs) for remote access. These vulnerabilities, CVE-2024-1708, which allows for authentication bypass, and CVE-2024-1709, which enables path traversal, began to be exploited shortly after their disclosure. Rated with a severity score of 10 on the CVSS due to … Continue reading “Critical ConnectWise ScreenConnect Flaws Patched: Urgent Update Advised”

SolarWinds Access Rights Manager (ARM) Multiple Vulnerabilities Allows Remote Code Execution

Security researchers at Trend Micro Zero Day Initiative discovered multiple vulnerabilities impacting SolarWinds Access Rights Manager (ARM). Successful exploitation of the vulnerabilities may allow the attackers to perform remote code execution on target systems. CVE-2024-23476, CVE-2024-23479, and CVE-2023-40057 are given critical severity ratings and CVSS scores of 9.6, 9.6, and 9.0, respectively. CVE-2024-23477 and CVE-2024-23478 … Continue reading “SolarWinds Access Rights Manager (ARM) Multiple Vulnerabilities Allows Remote Code Execution”

QNAP QTS OS Command Injection Vulnerabilities (CVE-2023-47218 & CVE-2023-50358)

Two OS command injection vulnerabilities impact the operating systems embedded in the firmware of QNAP’s popular network-attached storage (NAS) devices. Tracked as CVE-2023-47218 and CVE-2023-50358, the vulnerabilities may allow users to execute commands via a network. The vulnerabilities affect QNAP operating systems such as QTS, QuTS Hero, and QuTS Cloud. CVE-2023-47218 can be exploited by … Continue reading “QNAP QTS OS Command Injection Vulnerabilities (CVE-2023-47218 & CVE-2023-50358)”