Jan 12, 2024
2 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
GitLab Community and Enterprise Editions Improper Access Control
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.
GitLab CE/EEClosed May 1, 2024
- ClosedHighNo fix needed
Midnight Blizzard breaches Microsoft corporate email
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Microsoft corporate email (Microsoft 365)Closed Apr 2, 2024
Updated
- ClosedCriticalPatched
Ivanti Connect Secure zero-days chained for mass VPN compromise
Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.
Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and NeuronsClosed Jan 31, 2024
