Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
An unspecified vulnerability in the JavaScriptCore component affects multiple Apple products including macOS, iOS, tvOS, Safari, and watchOS. This flaw may allow arbitrary code execution when processing web content. The affected products could include versions that are end-of-life or end-of-service, and users are advised to discontinue use of impacted products. Exploitation of this vulnerability has been observed in the wild.
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update.
Fax modem hardware dependent on this specific driver will no longer work on Windows.
Microsoft recommends removing any existing dependencies on this hardware.
SKYSEA Client View suffers from an improper authentication vulnerability that enables remote code execution through a flaw in how authentication is processed on the TCP connection with the management console. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided.
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CVE-2021-43798 is a path traversal vulnerability in Grafana that allows unauthorized access to local files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2021-22555 is a heap out-of-bounds write vulnerability in the Linux Kernel that can be exploited by an attacker to gain elevated privileges or cause a denial of service through heap memory corruption. The vulnerability arises from improper handling of user namespace operations. It has been observed to be exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow remote code execution. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits for this vulnerability have been observed in the wild.
CVE-2021-43226 is a privilege escalation vulnerability in the Microsoft Windows Common Log File System Driver. It allows a local attacker with some privileges to bypass certain security mechanisms, potentially leading to elevated privileges. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2013-3918 is an out-of-bounds write vulnerability in the Microsoft Windows InformationCardSigninHelper Class ActiveX control (icardie.dll). An attacker can exploit this by crafting a malicious webpage that, when viewed by a user, may allow remote code execution with the same privileges as the current user. The affected Windows product may be end-of-life or end-of-service, and users are advised to discontinue its use.
CVE-2011-3402 is a high-severity remote code execution vulnerability in the Microsoft Windows kernel, specifically in the TrueType font parsing engine within win32k.sys. This flaw allows remote attackers to execute arbitrary code by delivering crafted font data embedded in Word documents or web pages. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2010-3765 is a critical heap buffer overflow vulnerability affecting multiple Mozilla products including Firefox, SeaMonkey, and Thunderbird. The flaw involves memory corruption triggered by JavaScript operations related to nsCSSFrameConstructor::ContentAppended, appendChild method, and frame creation. It allows remote attackers to execute arbitrary code when JavaScript is enabled. The vulnerability was actively exploited in the wild and was fixed in Firefox 3.5.15, 3.6.12, SeaMonkey 2.0.10, and Thunderbird 3.0.10 and 3.1.6.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
GNU Bash contains an OS command injection vulnerability (CVE-2014-6278) that allows remote attackers to execute arbitrary commands via a crafted environment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
Jenkins contains a remote code execution vulnerability identified as CVE-2017-1000353. The flaw allows attackers to send a serialized Java SignedObject to the Jenkins CLI remoting interface, which is then deserialized using a new ObjectInputStream. This process bypasses the existing blocklist-based protection, enabling remote code execution. The vulnerability has been exploited in the wild.
