Apr 22, 2024
2 new incidents, 1 with updates.
Started
- ClosedPatched
Apache HugeGraph-Server Improper Access Control
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.
Apache HugeGraph-ServerClosed Sep 18, 2024
- ClosedPatched
CrushFTP VFS Sandbox Escape
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). Added to the CISA KEV catalog on 2024-04-24.
CrushFTPClosed Apr 24, 2024
Updated
- ClosedCriticalNo fix needed
Change Healthcare ransomware attack (ALPHV/BlackCat)
The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).
Change Healthcare (UnitedHealth Group / Optum)Closed Oct 22, 2024
