Vulnerabilityhigh
⚡ THN Recap: Top Cybersecurity Threats, Tools and Tips (Dec 2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-2120 | Cross-Site Scripting in Cisco ASA WebVPN Login Page | — | 23% | KEV | — KEV |
| CVE-2023-45727 | Unauthenticated XXE File-Read in North Grid Proself (CVE-2023-45727) | 7.5 | 5% | KEV | KEV |
| CVE-2024-10905 | IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior… | 9.8 | <1% | ||
| CVE-2024-11667 | Unauthenticated Path Traversal in Zyxel ATP, USG FLEX, and USG20-VPN Firewalls | 9.8 | 3% | KEVRansomware | KEV |
| CVE-2024-11680 | Unauthenticated Config Tampering and Webshell Upload in ProjectSend (pre-r1720) | 9.8 | 92% | KEVPoC | KEV |
| CVE-2024-12053 | Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page | 8.8 | <1% | ||
| CVE-2024-12209 | Unauthenticated Local File Inclusion in WP Umbrella WordPress Plugin through 2.17.0 | 9.8 | 23% | ||
| CVE-2024-20397 | A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an… | 5.2 | <1% | ||
| CVE-2024-29014 | Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when… | 8.8 | 2% | ||
| CVE-2024-38193 | Use-After-Free Privilege Escalation in Microsoft Windows WinSock Driver (afd.sys) | 7.8 | 29% | KEVPoC | KEV |
| CVE-2024-41713 | Unauthenticated Path Traversal in Mitel MiCollab NuPoint Unified Messaging | 9.1 | 97% | KEVRansomware | KEV |
| CVE-2024-42448 | Authorized-agent RCE in Veeam Service Provider Console (VSPC) | 9.9 | 20% | ||
CVE-2024-49805+1 related CVE | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own… | 9.8 group max | <1% | ||
| CVE-2024-51378 | Unauthenticated Command Injection in CyberPanel | 9.8 | 95% | KEVRansomwarePoC ×2 | KEV |
| CVE-2024-52316 | Unchecked Error Condition vulnerability in Apache Tomcat | 9.8 | 6% | ||
| CVE-2024-52338 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution | 9.8 | 2% | ||
| CVE-2024-5921 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary… | 7.1 | 1% | PoC |
From the original article
10 min read at thehackernews.com
Ravie Lakshmanan Dec 09, 2024 Cyber Threats / Weekly Recap This week’s cyber world is like a big spy movie. Hackers are breaking into other hackers’ setups, sneaky malware is hiding in popular software, and AI-powered scams are tricking even the smartest of us.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.