Dec 3, 2024
3 new incidents, 2 with updates.
Started
- ClosedPatched
Cleo file transfer zero-days exploited by Clop for data theft
Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.
Cleo Multiple ProductsClosed Dec 17, 2024
- ClosedPatched
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. Added to the CISA KEV catalog on 2024-12-03. CVE-2023-45727 was assigned before 2024; the KEV listing came in 2024.
North Grid ProselfClosed Dec 3, 2024
- ClosedPatched
@solana/web3.js npm package backdoored to steal private keys
A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.
@solana/web3.js (npm)Closed Dec 4, 2024
Updated
- ClosedPatched
Zyxel Multiple Firewalls Path Traversal
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.
Zyxel Multiple FirewallsClosed Dec 3, 2024
- ClosedPatched
ProjectSend Improper Authentication
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.
ProjectSendClosed Dec 3, 2024
