Threat database

A use-after-free (UAF) vulnerability exists in the network route management component of the Linux kernel used in Red Hat Enterprise Linux. This vulnerability is addressed by a kernel live patch module for kernel version 5.14.0-284.48.1.el9_2. The patch can be applied using the kpatch utility to modify the running kernel without rebooting. The issue is tracked as CVE-2024-36971 and has been rated with an Important security impact by Red Hat.

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.   However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

CVE-2024-38107 is a high-severity privilege escalation vulnerability in the Microsoft Windows Power Dependency Coordinator component. It allows a local attacker with limited privileges to escalate to SYSTEM-level privileges. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2024-38106 is a high-severity privilege escalation vulnerability in the Microsoft Windows Kernel. It involves a race condition that allows a local attacker with limited privileges to escalate to SYSTEM privileges. The vulnerability has been exploited in the wild. No specific affected Windows versions or patch information is provided in the available data.

CVE-2024-38193 is a high-severity privilege escalation vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock. It allows a local attacker with limited privileges to escalate to SYSTEM-level privileges. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.

CVE-2024-38178 is a high-severity memory corruption vulnerability in the Microsoft Windows Scripting Engine. It allows an unauthenticated attacker to execute remote code by crafting a malicious URL. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Microsoft Project contains a remote code execution vulnerability identified as CVE-2024-38189. This flaw can be exploited by opening a specially crafted malicious file, potentially allowing an attacker to execute arbitrary code on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.8 and is known to be exploited in the wild. No specific affected versions or patch information is provided at this time.

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

CVE-2018-0824 is a vulnerability in Microsoft COM for Windows involving deserialization of untrusted data. This flaw can be exploited via specially crafted files or scripts to achieve privilege escalation and remote code execution. It has been observed exploited in the wild. No specific affected versions or patch information is provided in the available data.

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

CVE-2012-4792 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code by triggering access to an improperly allocated or deleted object, specifically demonstrated with a CDwnBindInfo object. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

VMware vCenter Server has a vulnerability due to incorrect default file permissions that can allow a remote, privileged attacker to access sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2024-21182 is a high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server.

CVE-2024-36401 is a critical remote code execution vulnerability in OSGeo GeoServer GeoTools caused by improper neutralization of directives in dynamically evaluated code. The flaw arises from unsafe evaluation of property names as XPath expressions, allowing unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS score of 9.8 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.