Zoom addressed a vulnerability that impacts the Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Tracked as CVE-2024-24691, the vulnerability has a critical severity with a CVSS score 9.6. The vulnerability may allow an unauthenticated user to escalate privilege with the help of network access.
Microsoft Patch Tuesday, February 2024 Security Update Review
The new Microsoft Patch Tuesday Edition for February 2024 is now live! We invite you to join us to review and discuss the details of these security updates and patches. Microsoft Patch Tuesday’s February 2024 edition addressed 79 vulnerabilities, including five critical and 66 important severity vulnerabilities. Microsoft has addressed two vulnerabilities known to be … Continue reading “Microsoft Patch Tuesday, February 2024 Security Update Review”
Critical Vulnerability in Shim Impacts Major Linux Distributors (CVE-2023-40547)
Shim is a crucial software most Linux distributions use in the boot process to support Secure Boot. At the start of the month, Bill Demirkapi of the Microsoft Security Response Center (MSRC) discovered a critical severity vulnerability impacting the software. Tracked as CVE-2023-40547, the vulnerability could lead to remote code execution, crash, denial of service, and exposure of … Continue reading “Critical Vulnerability in Shim Impacts Major Linux Distributors (CVE-2023-40547)”
Ivanti Connect Secure and Ivanti Policy Secure XML External Entity (XXE) Vulnerability (CVE-2024-22024)
Ivanti has warned users to patch an XML external entity vulnerability impacting Connect Secure, Policy Secure, and ZTA gateways. CVE-2024-22024 may allow an attacker to access certain restricted resources without authentication. Ivanti has mentioned in the advisory, “We have no evidence of this vulnerability being exploited in the wild as it was found during our internal review … Continue reading “Ivanti Connect Secure and Ivanti Policy Secure XML External Entity (XXE) Vulnerability (CVE-2024-22024)”
FortiOS Out-of-Bound Write Vulnerability Under Active Exploitation (CVE-2024-21762)
Fortinet has addressed an out-of-bounds write vulnerability impacting FortiOS. Tracked as CVE-2024-21762, the vulnerability has a critical severity rating with a CVSS score 9.6. Successful exploitation of the vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests. Fortinet quoted in the advisory that vulnerability is potentially exploited … Continue reading “FortiOS Out-of-Bound Write Vulnerability Under Active Exploitation (CVE-2024-21762)”
Cisco Addresses Cross-Site Request Forgery Vulnerabilities in Expressway Series (CVE-2024-20252, CVE-2024-20254, & CVE-2024-20255)
Cisco Expressway Series devices are vulnerable to three high and critical severity flaws that may lead to cross-site request forgery (CSRF) attacks. Tracked as CVE-2024-20252, CVE-2024-20254, & CVE-2024-20255, the vulnerabilities may sometimes allow an unauthenticated, remote attacker to perform arbitrary actions on an affected device. There is no evidence suggesting the active exploitation of any of … Continue reading “Cisco Addresses Cross-Site Request Forgery Vulnerabilities in Expressway Series (CVE-2024-20252, CVE-2024-20254, & CVE-2024-20255)”
JetBrains TeamCity On-Premises Authentication Bypass vulnerability (CVE-2024-23917)
JetBrains has released a patch to address a critical flaw tracked as CVE-2024-23917. The vulnerability in TeamCity On-Premises may allow an attacker to gain admin privileges on successful exploitation.
Docker Patches Multiple Vulnerabilities Impacting Runc, BuildKit, and Moby (Leaky Vessels)
Security researchers at Snyk have discovered four vulnerabilities in the core container infrastructure components, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653. The researchers have collect named the vulnerabilities Leaky Vessels. Attackers may exploit these container escape flaws to gain unauthorized access to the underlying host operating system from within the container. An attacker may access … Continue reading “Docker Patches Multiple Vulnerabilities Impacting Runc, BuildKit, and Moby (Leaky Vessels)”
Ivanti Releases Patch for Vulnerabilities Impacting Connect Secure and Policy Secure (CVE-2024-21888 & CVE-2024-21893)
Ivanti Connect Secure and Policy Secure are vulnerable to high-severity flaws (CVE-2024-21888 & CVE-2024-21893) that may lead to privilege escalation and arbitrary code execution on vulnerable systems. One of the flaws tracked as CVE-2024-21893 is being exploited in the wild. Ivanti mentioned in the advisory that they are aware of a few customers who have … Continue reading “Ivanti Releases Patch for Vulnerabilities Impacting Connect Secure and Policy Secure (CVE-2024-21888 & CVE-2024-21893)”
Ivanti Avalanche Directory Traversal Vulnerability (CVE-2023-41474)
Ivanti Avalanche, a popular mobile device management system, is vulnerable to a limited unauthenticated path traversal vulnerability, tracked as CVE-2023-41474. The vulnerability may allow an unauthenticated attacker to access any file under C:\\PROGRAM DATA\\Wavelink\\AVALANCHE\\Web\ webapps\AvalancheWeb in a default configuration. However, an attacker can only read some specific file extensions like .xml or .html, depending on the … Continue reading “Ivanti Avalanche Directory Traversal Vulnerability (CVE-2023-41474)”
