Nov 18, 2024
2 new incidents, 1 with updates.
Started
- ClosedPatched
Palo Alto PAN-OS management interface auth bypass + privilege escalation
CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.
Palo Alto Networks PAN-OSClosed Nov 18, 2024
- ClosedPatched
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. Added to the CISA KEV catalog on 2024-11-21.
Oracle Agile Product Lifecycle Management (PLM)Closed Nov 21, 2024
Updated
- ClosedPatched
Progress Kemp LoadMaster OS Command Injection
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.
Progress Kemp LoadMasterClosed Nov 18, 2024
