Jul 29, 2024

Updated

• Closed✓Patched

  Acronis Cyber Infrastructure (ACI) Insecure Default Password

  Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. Added to the CISA KEV catalog on 2024-07-29. CVE-2023-45249 was assigned before 2024; the KEV listing came in 2024.

  Acronis Cyber Infrastructure (ACI)·Closed Jul 29, 2024·updated Jul 29, 2024

• Closed✓Patched

  ServiceNow Utah, Vancouver, and Washington DC Now Platform: 2 actively exploited vulnerabilities

  CVE-2024-4879: ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. CVE-2024-5217: ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. Added to the CISA KEV catalog on 2024-07-29.

  ServiceNow Utah, Vancouver, and Washington DC Now Platform·Closed Jul 29, 2024·updated Jul 29, 2024