Oct 9, 2024
2 new incidents, 3 with updates.
Started
- ClosedPatched
Mozilla Firefox Use-After-Free
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.
Mozilla FirefoxClosed Oct 15, 2024
- ClosedHighNo fix needed
Internet Archive hacked: 31 million user records stolen
Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.
Internet Archive (archive.org)Closed Oct 20, 2024
Updated
- ClosedPatched
Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor
Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.
Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)Closed Oct 9, 2024
- ClosedPatched
Palo Alto Networks Expedition: 3 actively exploited vulnerabilities
CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.
Palo Alto Networks ExpeditionClosed Nov 14, 2024
- ClosedPatched
Fortinet Multiple Products Format String
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-09.
Fortinet Multiple ProductsClosed Oct 9, 2024
