May 30, 2024
0 new incidents, 3 with updates.
Updated
- ClosedPatched
Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.
Check Point Quantum Security GatewaysClosed May 30, 2024
- ClosedCriticalNo fix needed
Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)
A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.
Snowflake customer instancesClosed Jul 12, 2024
- ClosedPatched
Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.
Linux KernelClosed May 30, 2024
