Jan 31, 2024
1 new incident, 2 with updates.
Started
- ClosedHighPatched
Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.
Linux KernelClosed May 30, 2024
Updated
- ClosedCriticalPatched
Ivanti Connect Secure zero-days chained for mass VPN compromise
Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.
Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and NeuronsClosed Jan 31, 2024
- ClosedHighPatched
Apple Multiple Products Memory Corruption
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.
Apple Multiple ProductsClosed Jan 31, 2024
