Aug 21, 2024
6 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
Dahua IP Camera Firmware: 2 actively exploited vulnerabilities
CVE-2021-33044: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. CVE-2021-33045: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-33044, CVE-2021-33045 were assigned before 2024; the KEV listing came in 2024.
Dahua IP Camera FirmwareClosed Aug 21, 2024
- ClosedCriticalPatched
SolarWinds Web Help Desk Hardcoded Credential
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. Added to the CISA KEV catalog on 2024-10-15.
SolarWinds Web Help DeskClosed Oct 15, 2024
- ClosedHighPatched
Google Chromium V8 Inappropriate Implementation
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-28.
Google Chromium V8Closed Aug 28, 2024
- ClosedHighPatched
Google Chromium V8 Type Confusion
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-26.
Google Chromium V8Closed Aug 26, 2024
- ClosedHighPatched
Linux Kernel Heap-Based Buffer Overflow
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. Added to the CISA KEV catalog on 2024-08-21. CVE-2022-0185 was assigned before 2024; the KEV listing came in 2024.
Linux KernelClosed Aug 21, 2024
- ClosedHighPatched
Microsoft Exchange Server Information Disclosure
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-31196 was assigned before 2024; the KEV listing came in 2024.
Microsoft Exchange ServerClosed Aug 21, 2024
Updated
- ClosedCriticalPatched
LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)
A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.
LiteSpeed Cache (WordPress plugin)Closed Aug 21, 2024
