Week in review: Google fixes yet another Chrome zero-day exploit, YouTube as a cybercrime channel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-43208 | Unauthenticated Deserialization RCE in NextGen Healthcare Mirth Connect | 9.8 | 85% | KEVRansomwarePoC ×2 | KEV |
| CVE-2024-22026 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary… | 6.7 | 1% | ||
| CVE-2024-27130 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions | 8.8 | 38% | ||
| CVE-2024-29849 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface | 9.8 | 38% | ||
| CVE-2024-4323 | A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3 | 9.8 | 27% | PoC | |
| CVE-2024-4985 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional… | 10.0 | 3% | ||
| CVE-2024-5274 | Google Chrome V8 Type Confusion Allows In-Sandbox RCE via Crafted HTML Pages | 9.6 | 8% | KEVPoC | KEV |
From the original article
5 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Google fixes yet another Chrome zero-day exploited in the wild (CVE-2024-5274) For the eighth time this year, Google has released an emergency update for its Chrome browser that fixes a zero-day vulnerability (CVE-2024-5274) with an in-the-wild exploit.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.