Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

CVE-2024-3019 is a vulnerability affecting Performance Co-Pilot (PCP) software versions 4.3.4 and later. The issue arises from the default configuration of the pmproxy service, which exposes the Redis backend server to the local network. Redis, used by pmproxy for data storage and caching, is accessible without authentication when pmproxy is running, allowing remote attackers on the local network to execute arbitrary commands with the privileges of the Redis user. This can lead to full system compromise, including unauthorized data access, modification, and denial of service. The pmproxy service is not enabled by default and must be started manually, typically through the Cockpit web interface's Metrics settings page. The vulnerability has a CVSS v3.1 score of 8.8, indicating high severity, with an attack vector of adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), but the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H). No known exploits have been reported in the wild yet, but the exposure of Redis to the local network without authentication presents a significant risk. The flaw is primarily a misconfiguration issue but can be exploited to gain remote command execution capabilities. Organizations using PCP with pmproxy enabled should assess their exposure, especially in environments where local network access is not tightly controlled. The vulnerability underscores the importance of securing backend services and limiting network exposure of critical components.

Detailed information about CVE-2024-3019: Exposure of Resource to Wrong Sphere. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-3019: Exposure of Resource to Wrong Sphere - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-3019: Exposure of Resource to Wrong Sphere

Threats Tagged 'cve-2024-3019'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-3019'

Lead Pen Test Professional