Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-51448 | Cacti provides an operational monitoring and fault management framework | 8.8 | 67% | PoC ×2 | |
| CVE-2023-7028 | Unauthenticated Account Takeover via Password Reset Flaw in GitLab CE/EE | 9.8 | 94% | KEVPoC ×2 | KEV |
| CVE-2024-20272 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an… | 9.8 | 2% | ||
| CVE-2024-20674 | Windows Kerberos Security Feature Bypass Vulnerability | 8.8 | 17% | ||
| CVE-2024-20700 | Windows Hyper-V Remote Code Execution Vulnerability | 7.5 | 4% |
From the original article
5 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Social engineer reveals effective tricks for real-world intrusions In this Help Net Security interview, Jayson E. Street, Chief Adversarial Officer at Secure Yeti, discusses intriguing aspects of social engineering and unconventional methods for gathering target information.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.