Aug 13, 2024
4 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
Ivanti Virtual Traffic Manager Authentication Bypass
Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.
Ivanti Virtual Traffic ManagerClosed Sep 24, 2024
- ClosedCriticalPatched
LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)
A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.
LiteSpeed Cache (WordPress plugin)Closed Aug 21, 2024
- ClosedCriticalPatched
SolarWinds Web Help Desk Deserialization of Untrusted Data
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-15.
SolarWinds Web Help DeskClosed Aug 15, 2024
- ClosedHighPatched
Microsoft August 2024: 6 actively exploited zero-days
CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.
Microsoft Project, WindowsClosed Aug 13, 2024
