May 20, 2024
1 new incident, 2 with updates.
Started
- ClosedPatched
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Added to the CISA KEV catalog on 2024-05-20. CISA lists known use in ransomware campaigns. CVE-2023-43208 was assigned before 2024; the KEV listing came in 2024.
NextGen Healthcare Mirth ConnectClosed May 20, 2024
Updated
- ClosedPatched
Google Chromium V8 Type Confusion
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. Added to the CISA KEV catalog on 2024-05-20.
Google Chromium V8Closed May 20, 2024
- ClosedCriticalNo fix needed
Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)
A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.
Snowflake customer instancesClosed Jul 12, 2024
