Data breachcritical
THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 04
- CVEs
- CVE-2020-12271CVE-2020-15069CVE-2020-29574CVE-2022-1040CVE-2022-3236CVE-2024-39719CVE-2024-39720CVE-2024-39721CVE-2024-39722CVE-2024-43093CVE-2024-10443CVE-2024-50387CVE-2024-50388CVE-2024-50389CVE-2024-20418CVE-2024-5910CVE-2024-42509CVE-2024-47460CVE-2024-33661CVE-2024-33662CVE-2024-8355CVE-2024-8360
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-12271 | SQL Injection RCE in Sophos SFOS Firewalls with WAN-Exposed Admin or User Portal | 9.8 | 42% | KEVRansomwarePoC | KEV |
| CVE-2020-15069 | Unauthenticated Buffer Overflow RCE in Sophos XG Firewall | 9.8 | 11% | KEV | KEV |
| CVE-2020-29574 | Unauthenticated SQL Injection in Sophos CyberoamOS WebAdmin | 9.8 | 5% | KEVRansomware | KEV |
| CVE-2022-1040 | Authentication Bypass Leading to Unauthenticated RCE in Sophos Firewall (SFOS) | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2022-3236 | Unauthenticated Code Injection RCE in Sophos Firewall (User Portal/Webadmin) | 9.8 | 99% | KEV | KEV |
| CVE-2024-10443 | Unauthenticated OS Command Injection RCE in Synology Photos and BeePhotos | 9.8 | 28% | ||
| CVE-2024-20418 | A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access… | 10.0 | 3% | ||
| CVE-2024-33661 | Portainer before 2.20.0 allows redirects when the target is not index.yaml | 9.1 | <1% | ||
| CVE-2024-33662 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function | 7.5 | <1% | ||
CVE-2024-39720+3 related CVEs | An issue was discovered in Ollama before 0.1.46 | 8.2 group max | 2% | PoC | |
CVE-2024-42509+1 related CVE | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… | 9.8 group max | 2% | ||
| CVE-2024-43093 | Local Privilege Escalation via Unicode Path Filter Bypass in Android Framework | 7.3 | <1% | KEV | KEV |
| CVE-2024-50387 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions | 10.0 | 10% | ||
| CVE-2024-50388 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync | 9.5 | 2% | ||
| CVE-2024-50389 | A SQL injection vulnerability has been reported to affect QuRouter | 9.5 | <1% | ||
| CVE-2024-5910 | Unauthenticated Admin Account Takeover in Palo Alto Networks Expedition | 9.3 | 92% | KEVPoC | KEV |
| CVE-2024-8355 | Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability | 6.8 | <1% | ||
| CVE-2024-8360 | Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability | 6.8 | <1% |
From the original article
10 min read at thehackernews.com
Ravie Lakshmanan Nov 11, 2024 Cybersecurity / Hacking News ⚠️ Imagine this: the very tools you trust to protect you online—your two-factor authentication, your car’s tech system, even your security software—turned into silent allies for hackers. Sounds like a scene from a thriller, right? Yet, in 2024, this isn’t fiction; it’s the new cyber reality.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.