Jan 10, 2024
2 new incidents, 0 with updates.
Started
- ClosedPatched
Ivanti Connect Secure zero-days chained for mass VPN compromise
Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.
Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and NeuronsClosed Jan 31, 2024
- ClosedPatched
Microsoft SharePoint Server Privilege Escalation
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Added to the CISA KEV catalog on 2024-01-10. CISA lists known use in ransomware campaigns. CVE-2023-29357 was assigned before 2024; the KEV listing came in 2024.
Microsoft SharePoint ServerClosed Jan 10, 2024
