May 31, 2024
3 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
Ivanti Endpoint Manager (EPM) SQL Injection
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Added to the CISA KEV catalog on 2024-10-02.
Ivanti Endpoint Manager (EPM)Closed Oct 2, 2024
- ClosedCriticalPatched
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request. Added to the CISA KEV catalog on 2024-07-09. CISA lists known use in ransomware campaigns.
Rejetto HTTP File ServerClosed Jul 9, 2024
- ClosedHighNo fix needed
Hugging Face Spaces secrets accessed without authorization
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.
Hugging Face SpacesClosed May 31, 2024
Updated
- ClosedCriticalNo fix needed
Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)
A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.
Snowflake customer instancesClosed Jul 12, 2024
