Threat database

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVE-2024-38080 is a privilege escalation vulnerability in Microsoft Windows Hyper-V that allows a local attacker with user-level permissions to gain SYSTEM privileges. It has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2024-38112 is a spoofing vulnerability in the Microsoft Windows MSHTML Platform that impacts confidentiality, integrity, and availability. It has a high severity with a CVSS score of 7.5 and is known to be exploited in the wild. The vulnerability requires user interaction and has a high attack complexity. No specific affected versions or patch information is provided in the available data.

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root. Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges: Nexus 3000 Series Switches Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later Nexus 9000 Series Switches in standalone NX-OS mode

CVE-2020-13965 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows a remote attacker to manipulate data by sending a malicious XML attachment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-2586 is a use-after-free vulnerability in the Linux Kernel's nft_object component that allows local attackers to escalate privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

OSGeo GeoServer JAI-EXT contains a code injection vulnerability (CVE-2022-24816) that can lead to remote code execution when Jiffle scripts are accepted via network requests in programs using jt-jiffle. This vulnerability has been exploited in the wild and is considered high severity.

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVE-2024-26169 is a high-severity vulnerability in the Microsoft Windows Error Reporting Service that allows a local attacker with user-level permissions to escalate privileges to SYSTEM level. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. It involves improper privilege management, enabling unauthorized privilege escalation without user interaction.

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

CVE-2017-3506 is an OS command injection vulnerability in Oracle WebLogic Server, part of the Fusion Middleware suite. It allows attackers to execute arbitrary code by sending a specially crafted HTTP request containing a malicious XML document. This vulnerability has been exploited in the wild. Oracle released patches for affected versions as part of their April 2017 Critical Patch Update and strongly recommends applying these patches promptly.