Apr 24, 2024
2 new incidents, 1 with updates.
Started
- ClosedHighPatched
Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign
Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Closed Apr 24, 2024
- ClosedHighNo fix needed
Dropbox Sign (HelloSign) production environment breached
A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.
Dropbox SignClosed Jun 21, 2024
Updated
- ClosedCriticalPatched
CrushFTP VFS Sandbox Escape
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). Added to the CISA KEV catalog on 2024-04-24.
CrushFTPClosed Apr 24, 2024
