Ransomwarecritical
THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 18
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-0012+1 related CVE | Authentication Bypass in Palo Alto Networks PAN-OS Management Interface | 9.3 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-0138 | NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component | 9.8 | <1% | ||
CVE-2024-10217+1 related CVE | XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence | 9.2 | <1% | ||
| CVE-2024-10224 | Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary… | 7.8 | 9% | PoC ×3 | |
| CVE-2024-10524 | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable | 6.5 | 1% | ||
CVE-2024-48990+3 related CVEs | Local Privilege Escalation in Ubuntu needrestart via attacker-controlled PYTHONPATH | 7.8 | 20% | ||
| CVE-2024-34719 | In multiple locations, there is a possible permissions bypass due to a missing null check | 7.8 | <1% | ||
CVE-2024-44308+1 related CVE | Arbitrary Code Execution via Crafted Web Content in Apple Safari, iOS, macOS and visionOS | 8.8 group max | 10% | KEV | KEV |
| CVE-2024-50306 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup | 9.1 | 2% | ||
| CVE-2024-51092 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index()… | 9.1 | 7% | PoC ×2 | |
| CVE-2024-52034 | An OS Command Injection vulnerability exists within myPRO Manager | 10.0 | 2% | ||
| CVE-2024-9942 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… | 9.8 | 1% |
From the original article
11 min read at thehackernews.com
Ravie Lakshmanan Nov 25, 2024 Cybersecurity / Critical Updates We hear terms like “state-sponsored attacks” and “critical vulnerabilities” all the time, but what’s really going on behind those words? This week’s cybersecurity news isn’t just about hackers and headlines—it’s about how digital risks shape our lives in ways we might not even realize.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.