AtRisk July 18, 2024 Vol. XXIV

Jump to:

Internet Storm Center Spotlight
Recent CVEs
Sponsors
Read More

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html Who You Gonna Call? AndroxGh0st Busters! [Guest Diary] Published: 2024-07-16 Last Updated: 2024-07-17 00:33:04 UTC by Guy Bruneau (Version: 1) [This is a Guest Diary by Michael Gallant, an ISC intern as part of the SANS.edu BACS program] Introduction During my internship at the SANS Internet Storm Center, I was tasked with setting up a honeypot, an internet device intentionally vulnerable, to observe and analyze attack vectors. Among the numerous attacks recorded, one particular observation stood out: the AndroxGh0st malware. This threat targets Laravel web applications and poses major risks to sensitive data. In this post, I aim to share my experience and raise awareness about AndroxGh0st, detailing its exploitation methods and providing strategies to defend against it. Understanding AndroxGh0st AndroxGh0st is a Python-scripted malware designed to target .env files that contain sensitive information in web applications, specifically those using the Laravel framework. This malware is part of a botnet operation that primarily aims to steal credentials and abuse other functions such as vulnerability scanning, Simple Mail Transfer Protocol (SMTP), application programming interfaces (APIs), and web shell deployment. What is Laravel? Laravel is an open-source PHP web application development framework. It simplifies development with built-in database interaction, authentication, routing, sessions, and caching features. Laravel is popular for designing web applications such as e-commerce platforms, social networking platforms, APIs (Application Programming Interfaces), and Content Management Systems (CMS). Laravel applications often handle critical data, making them attractive targets for attackers. The added complexity of Laravel can lead to security oversights, providing opportunities for exploitation and including exposed default settings or sensitive files, making it easier for attackers to gain access. Read the full entry: https://isc.sans.edu/diary/Who+You+Gonna+Call+AndroxGh0st+Busters+Guest+Diary/31086/ "Reply-chain phishing" with a twist Published: 2024-07-16 Last Updated: 2024-07-16 12:45:28 UTC by Jan Kopriva (Version: 1) Few weeks ago, I was asked by a customer to take a look at a phishing message which contained a link that one of their employees clicked on. The concern was whether the linked-to site was only a generic credential stealing web page or something targeted/potentially more dangerous. Luckily, it was only a run-of-the-mill phishing kit login page, nevertheless, the e-mail message itself turned out to be somewhat more interesting, since although it didn’t look like anything special, it did make it to the recipient’s inbox, instead of the e-mail quarantine where it should have ended up. The reason for this probably was that the message in question contained what looked like a reply to a previous e-mail exchange. This might have made it appear more trustworthy to the spam/phishing detection mechanisms that were employed to scan it, since – as far as my understanding goes – automated spam/phishing detection mechanisms tend to consider messages with reply-chains to be somewhat more trustworthy than plain, unsolicited e-mails from unknown senders. It should be mentioned that threat actors commonly use replies to legitimate messages in account takeover/BEC-style phishing attacks, however, in this case, the situation was somewhat different – the original (replied-to) message was from someone not associated with the targeted organization in any way. Use of this approach (i.e., “replying” to a message with no relevance to the recipient) can sometimes be seen in generic phishing, however, if someone receives an e-mail which contains a reply to a message from someone they have never even heard of, it doesn’t exactly make the message appear trustworthy… Which is where the slight twist, which was used in this message, comes in. In the message, the ”reply” part was hidden from the recipient bellow a long list of empty paragraphs (well, paragraphs containing a non-breaking space). And although this technique is not new, since the aforementioned customer’s IT specialists weren’t aware of it, and a quick Google search failed to provide any write-ups of it, I thought it might be worthwhile to go over it here. As the following example from my “phishing collection” shows, at first glance, an e-mail messages, in which this technique is used, would look quite normal, and a recipient might not notice anything suspicious (besides the overall “this is an obvious phishing” vibe). Read the full entry: https://isc.sans.edu/diary/Replychain+phishing+with+a+twist/31084/ Protected OOXML Spreadsheets Published: 2024-07-15 Last Updated: 2024-07-15 04:54:57 UTC by Didier Stevens (Version: 1) I was asked a question about the protection of an .xlsm spreadsheet. I've written before on the protection of .xls spreadsheets, for example in diary entries "Unprotecting Malicious Documents For Inspection" and "16-bit Hash Collisions in .xls Spreadsheets"; and blog post "Quickpost: oledump.py plugin_biff.py: Remove Sheet Protection From Spreadsheets". .xlsm spreadsheats (and .xlsx) are OOXML files, and are thus ZIP files containing mostly XML files ... Read the full entry: https://isc.sans.edu/diary/Protected+OOXML+Spreadsheets/31070/

Wireshark 4.2.6 Released (2024.07.14) https://isc.sans.edu/diary/Wireshark+426+Released/31068/ 16-bit Hash Collisions in .xls Spreadsheets (2024.07.13) https://isc.sans.edu/diary/16bit+Hash+Collisions+in+xls+Spreadsheets/31066/ Attacks against the "Nette" PHP framework CVE-2020-15227 (2024.07.12) https://isc.sans.edu/diary/Attacks+against+the+Nette+PHP+framework+CVE202015227/31076/ Understanding SSH Honeypot Logs: Attackers Fingerprinting Honeypots (2024.07.11) https://isc.sans.edu/diary/Understanding+SSH+Honeypot+Logs+Attackers+Fingerprinting+Honeypots/31064/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

Product: Microsoft Windows 10 1507 CVSS Score: 7.5 ** KEV since 2024-07-09 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38112 ISC Podcast: https://isc.sans.edu/podcastdetail/9048 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112

Product: Oracle Communications_Diameter_Signaling_Router CVSS Score: 0 ** KEV since 2022-02-15 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-9841 ISC Diary: https://isc.sans.edu/diary/31086

Product: Laravel CVSS Score: 0 ** KEV since 2024-01-16 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-15133 ISC Diary: https://isc.sans.edu/diary/31086

Product: Apache HTTP Server 2.4.49 CVSS Score: 0 ** KEV since 2021-11-03 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-41773 ISC Diary: https://isc.sans.edu/diary/31086

Product: Microsoft Windows 11 21H2 CVSS Score: 7.8 ** KEV since 2024-07-09 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38080 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38080

Product: The Product Table by WBW plugin for WordPress CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6365 NVD References: - https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php - https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php#L7 - https://plugins.trac.wordpress.org/changeset/3113335/ - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=cve

Product: SEOPress WordPress plugin CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5488 NVD References: https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/

Product: Weintek SmartSPS CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28747 NVD References: https://cert.vde.com/en/advisories/VDE-2024-012

Product: Siemens Simatic HMI TP700. CVSS Score: 9.1 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28751 NVD References: https://cert.vde.com/en/advisories/VDE-2024-012

Product: ZealousWeb Generate PDF using Contact Form 7 CVSS Score: 9.1 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37555 NVD References: https://patchstack.com/database/vulnerability/generate-pdf-using-contact-form-7/wordpress-generate-pdf-using-contact-form-7-plugin-4-0-6-arbitrary-file-upload-vulnerability?_s_id=cve

Product: WordPress Gutenberg Forms plugin CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6313 NVD References: - https://plugins.trac.wordpress.org/browser/forms-gutenberg/tags/2.2.9/Utils/Bucket.php#L19 - https://plugins.trac.wordpress.org/browser/forms-gutenberg/tags/2.2.9/triggers/email.php#L268 - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0315b53-46a1-46b4-a53e-0d914866ca50?source=cve

Product: WordPress IQ Testimonials plugin CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6314 NVD References: - https://plugins.trac.wordpress.org/browser/iq-testimonials/tags/2.2.7/lib/iq-testimonials-form.php#L296 - https://www.wordfence.com/threat-intel/vulnerabilities/id/bec50640-a550-49a8-baf6-2dd53995f90b?source=cve

Product: WishList Member X Membership Software CVSS Score: 10.0 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37112 NVD References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-arbitrary-sql-query-execution-vulnerability?_s_id=cve

Product: WishList Member X Membership Software CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37113 NVD References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-database-backup-download-vulnerability?_s_id=cve

Product: WordPress OSM – OpenStreetMap plugin CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-3604 NVD References: - https://wordpress.org/plugins/osm/ - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eebc67-e590-4d7f-8925-e5e5090cedf0?source=cve

Product: Andy Moyle Church Admin CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37418 NVD References: https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-4-6-arbitrary-file-upload-vulnerability?_s_id=cve

Product: WPZita Zita Elementor Site Library CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37420 NVD References: https://patchstack.com/database/vulnerability/zita-site-library/wordpress-zita-elementor-site-library-plugin-1-6-1-arbitrary-code-execution-vulnerability?_s_id=cve

Product: Automattic Newspack Blocks CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37424 NVD References: https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-arbitrary-file-upload-vulnerability?_s_id=cve

Product: Siemens SINEMA Remote Connect Server CVSS Score: 9.6 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39872 NVD References: https://cert-portal.siemens.com/productcert/html/ssa-381581.html

Product: Mozilla Firefox CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6602 NVD References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1895032 - https://www.mozilla.org/security/advisories/mfsa2024-29/ - https://www.mozilla.org/security/advisories/mfsa2024-30/ - https://www.mozilla.org/security/advisories/mfsa2024-31/ - https://www.mozilla.org/security/advisories/mfsa2024-32/

Product: Mozilla Firefox CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6606 NVD References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1902305 - https://www.mozilla.org/security/advisories/mfsa2024-29/ - https://www.mozilla.org/security/advisories/mfsa2024-32/

Product: Mozilla Firefox CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6611 NVD References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1844827 - https://www.mozilla.org/security/advisories/mfsa2024-29/ - https://www.mozilla.org/security/advisories/mfsa2024-32/

CVE-2024-38023 & CVE-2024-38024 - Microsoft SharePoint Server Remote Code Execution Vulnerabilities Product: Microsoft Sharepoint Server CVSS Score: 7.2 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38023 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38024 ISC Podcast: https://isc.sans.edu/podcastdetail/9048 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38023 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38024

Product: Microsoft Windows Server 2008 CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38074 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38074

Product: Microsoft Windows Server 2016 CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38076 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38076

Product: Microsoft Windows Server 2008 CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38077 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

Product: Microsoft Defender For IoT CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38089 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38089

Product: Microsoft Sharepoint Server CVSS Score: 7.2 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38094 ISC Podcast: https://isc.sans.edu/podcastdetail/9048 NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094

Product: PHPVibe CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39171 NVD References: - http://phpvibe.com - https://github.com/751897386/PHPVibe_vulnerability_Directory-Traversal

Product: Learning Management System Project In PHP With Source Code CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37870 NVD References: https://github.com/TThuyyy/cve1/issues/3

Product: Fujian Kelixun send_event CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39071 NVD References: https://gist.github.com/Y5neKO/561a038dab8584c1448aad3013b9c2c7

Product: Pepperl+Fuchs CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6422 NVD References: https://cert.vde.com/en/advisories/VDE-2024-038

CVE-2024-4879 & CVE-2024-5217 - ServiceNow has fixed two validation vulnerabilities Product: ServiceNow Now Platform CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-4879 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5217 NVD References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154 - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313

Product: 14Finger v1.1 CVSS Score: 9.1 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37770 NVD References: - https://github.com/b1ackc4t/14Finger/issues/13 - https://github.com/k3ppf0r/CVE-2024-37770

Product: EVerest EV charging software stack CVSS Score: 9.0 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37310 NVD References: - https://github.com/EVerest/everest-core/commit/f73620c4c0f626e1097068a47e10cc27b369ad8e - https://github.com/EVerest/everest-core/releases/tag/2024.3.1 - https://github.com/EVerest/everest-core/releases/tag/2024.6.0 - https://github.com/EVerest/everest-core/security/advisories/GHSA-8g9q-7qr9-vc96

Product: Whale browser CVSS Score: 9.6 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40618 NVD References: https://cve.naver.com/detail/cve-2024-40618.html

Product: InstaWP Connect CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6397 NVD References: - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/apis/class-instawp-rest-api.php#L256 - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28 - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L40 - https://plugins.trac.wordpress.org/changeset/3109305/ - https://plugins.trac.wordpress.org/changeset/3114674/ - https://www.wordfence.com/threat-intel/vulnerabilities/id/963f2485-3afa-4e17-8278-b75415af3915?source=cve

Product: GitLab CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6385 NVD References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469217 -

Product: Parorrey JSON API User CVSS Score: 9.8 AtRiskScore 30 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6624 NVD References: - https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187 - https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51 - https://plugins.trac.wordpress.org/changeset/3115185/ - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff?source=cve

Product: Supermicro BMC firmware CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36435 NVD References: https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Jul_2024

Product: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6328 NVD References: - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L699 - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L714 - https://plugins.trac.wordpress.org/changeset/3115231/ - https://www.wordfence.com/threat-intel/vulnerabilities/id/17d8e2e9-5e3f-433b-be1a-6ea765eba547?source=cve

Product: NooTheme Jobmonster CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37927 NVD References: https://patchstack.com/database/vulnerability/noo-jobmonster/wordpress-jobmonster-theme-4-7-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve

Product: anhvnit Woocommerce OpenPos CVSS Score: 9.3 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37933 NVD References: https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sql-injection-vulnerability?_s_id=cve

Product: FOG Project CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39914 NVD References: - https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f - https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j

Product: SpreadsheetConverter Import Spreadsheets from Microsoft Excel CVSS Score: 9.1 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38734 NVD References: https://patchstack.com/database/vulnerability/import-spreadsheets-from-microsoft-excel/wordpress-import-spreadsheets-from-microsoft-excel-plugin-10-1-4-arbitrary-file-upload-vulnerability?_s_id=cve

Product: Realtyna Organic IDX plugin CVSS Score: 9.1 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38736 NVD References: https://patchstack.com/database/vulnerability/real-estate-listing-realtyna-wpl/wordpress-realtyna-organic-idx-plugin-4-14-13-arbitrary-file-upload-vulnerability?_s_id=cve

Product: Codermy My-Springsecurity-Plus CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40539 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40540 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40541 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40542 NVD References: - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAE8U - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAGZY - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8A - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAHCR

Product: IBM Datacap CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39736 NVD References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/296003 - https://www.ibm.com/support/pages/node/7160185

Product: Space Management System Project CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6743 NVD References: - https://www.twcert.org.tw/en/cp-139-7933-9a38d-2.html - https://www.twcert.org.tw/tw/cp-132-7932-a6d4d-1.html

Product: Cellopoint Secure Email Gateway CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6744 NVD References: - https://www.twcert.org.tw/en/cp-139-7937-acbb5-2.html - https://www.twcert.org.tw/tw/cp-132-7936-f6381-1.html

Product: Thruk CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39915 NVD References: - https://github.com/sni/Thruk/commit/7e7eb251e76718a07639c4781f0d959d817f173b - https://github.com/sni/Thruk/security/advisories/GHSA-r7gx-h738-4w6f

Product: TorrentPier CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40624 NVD References: - https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60 - https://github.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e - https://github.com/torrentpier/torrentpier/security/advisories/GHSA-fg86-4c2r-7wxw

Product: HUSKY Products Filter Professional for WooCommerce

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6457

NVD References:

https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_author/index.php#L102
https://plugins.trac.wordpress.org/changeset/3116888/
https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=cve

Product: Microsoft Windows Authentication CVSS Score: 9.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-22442 NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04663en_us&docLocale=en_US

Product: JupyterLab copier CVSS Score: 9.9 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39700 NVD References: - https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6 - https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS

Xona Systems

SANS

Carahsoft

SEC536: Adversarial AI - Penetration Testing AI Systems

The Consensus Security Vulnerability Alert

Share

Internet Storm Center Spotlight

Internet Storm Center Entries

Recent CVEs

CVE-2024-38112 - Windows MSHTML Platform Spoofing Vulnerability

CVE-2017-9841 - PHPUnit Command Injection Vulnerability

CVE-2018-15133 - Laravel Deserialization of Untrusted Data Vulnerability

CVE-2021-41773 - Apache HTTP Server Path Traversal Vulnerability

CVE-2024-38080 - Windows Hyper-V Elevation of Privilege Vulnerability

CVE-2024-6365 - The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 2.0.1, allowing unauthenticated attackers to execute code on the server via the 'saveCustomTitle' function.

CVE-2024-5488 - The SEOPress WordPress plugin before 7.9 has a vulnerability that allows unauthenticated attackers to exploit Object Injection and access malicious gadget chains.

CVE-2024-28747 - An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

CVE-2024-28751 - An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.&nbsp;

CVE-2024-37555 - ZealousWeb Generate PDF using Contact Form 7 allows unrestricted upload of files with dangerous types, posing a security risk from versions n/a through 4.0.6.

CVE-2024-6313 - The Gutenberg Forms plugin for WordPress allows for arbitrary file uploads, potentially leading to remote code execution.

CVE-2024-6314 - The IQ Testimonials plugin for WordPress allows unauthenticated attackers to upload arbitrary files and potentially execute remote code due to insufficient file validation, in versions up to 2.2.7, only if the 'gd' PHP extension is not loaded.

CVE-2024-37112 - WishList Member X is vulnerable to SQL Injection before version 3.26.7, allowing attackers to manipulate database queries.

CVE-2024-37113 - WishList Member X is vulnerable to exposing sensitive information to unauthorized actors before version 3.26.7.

CVE-2024-3604 - The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode.

CVE-2024-37418 - Andy Moyle Church Admin is vulnerable to uploading potentially harmful files, such as web shells, to a web server due to an unrestricted upload vulnerability.

CVE-2024-37420 - Zita Elementor Site Library in WPZita allows uploading a web shell to a web server due to unrestricted upload of dangerous file types, affecting versions from n/a to 1.6.1.

CVE-2024-37424 - Newspack Blocks allows unrestricted upload of dangerous file types, potentially enabling the upload of a web shell to a web server.

CVE-2024-39872 - SINEMA Remote Connect Server (All versions &lt; V3.2 SP1) allows authenticated attackers with the 'Manage firmware updates' role to escalate privileges via improper assignment of rights to temporary files.

CVE-2024-6602 - Firefox versions less than 128 and Firefox ESR versions less than 115.13 are vulnerable to memory corruption due to a mismatch between allocator and deallocator.

CVE-2024-6606 - Firefox is vulnerable to an out-of-bounds read due to clipboard code failing to check the index on an array access.

CVE-2024-6611 - A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox &lt; 128.

CVE-2024-38023 & CVE-2024-38024 - Microsoft SharePoint Server Remote Code Execution Vulnerabilities

CVE-2024-38074 - Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

CVE-2024-38076 - Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

CVE-2024-38077 - Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

CVE-2024-38089 - Microsoft Defender for IoT Elevation of Privilege Vulnerability

CVE-2024-38094 - Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2024-39171 - PHPVibe v11.0.46 is vulnerable to directory travel, allowing for code execution by writing specific statements to .htaccess and a file with a .png suffix.

CVE-2023-48194 - Tenda AC8v4 is vulnerable to a buffer overflow attack in the set_client_qos function, allowing an attacker to gain control over the gp register.

CVE-2024-37870 - Learning Management System Project In PHP With Source Code 1.0 is vulnerable to SQL injection through the id parameter in processscore.php, allowing attackers to execute arbitrary SQL commands.

CVE-2024-39071 - Fujian Kelixun &lt;=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.

CVE-2024-6422 - Pepperl+Fuchs Anonymous FTP server and Telnet access allows information disclosure and manipulation. An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data.

CVE-2024-4879 & CVE-2024-5217 - ServiceNow has fixed two validation vulnerabilities

CVE-2024-37770 - 14Finger v1.1 contains a remote command execution vulnerability that lets attackers run arbitrary commands.

CVE-2024-37310 - EVerest EV charging software stack is vulnerable to a remote integer overflow in the "v2g_incoming_v2gtp" function, fixed in versions 2024.3.1 and 2024.6.0.

CVE-2024-40618 - Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.

CVE-2024-6397 - The InstaWP Connect plugin for WordPress allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, due to an insufficient verification of the API key.

CVE-2024-6385 - GitLab CE/EE versions prior to 17.1.2 allow an attacker to trigger a pipeline as another user.

CVE-2024-6624 - The JSON API User plugin for WordPress allows unauthenticated attackers to escalate privileges by exploiting improper controls on custom user meta fields, leading to potential administrator registration.

CVE-2024-36435 - Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules) allows for arbitrary remote code execution due to a stack buffer overflow vulnerability.

CVE-2024-6328 - The MStore API plugin for WordPress is vulnerable to authentication bypass, allowing attackers to impersonate any existing user or create new user accounts.

CVE-2024-37927 - Improper Privilege Management vulnerability in NooTheme Jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through 4.7.0.

CVE-2024-37933 - Woocommerce OpenPos is vulnerable to SQL Injection from versions n/a through 6.4.4.

CVE-2024-39914 - FOG inventory management system prior to 1.5.10.34 is vulnerable to command injection via the filename parameter in export.php.

CVE-2024-38734 - Import Spreadsheets from Microsoft Excel allows code injection due to unrestricted upload of dangerous file types.

CVE-2024-38736 - Realtyna Organic IDX plugin allows for Code Injection through Unrestricted Upload of File with Dangerous Type vulnerability.

CVE-2024-40539 through CVE-2024-40542 - my-springsecurity-plus before v2024.07.03 was discovered to contain SQL injection vulnerabilities

CVE-2024-39736 - IBM Datacap Navigator versions 9.1.5 through 9.1.9 is vulnerable to HTTP header injection, potentially enabling attackers to conduct various attacks like cross-site scripting or session hijacking.

CVE-2024-6743 - AguardNet's Space Management System is vulnerable to SQL injection attacks, enabling unauthorized users to access and manipulate database data.

CVE-2024-6744 - Cellopoint's Secure Email Gateway SMTP Listener allows unauthenticated remote attackers to execute arbitrary system commands due to improper validation of user input.

CVE-2024-39915 - Thruk allows authorized users to inject arbitrary commands via the URL parameter during PDF report generation, leading to an authenticated RCE vulnerability.

CVE-2024-40624 - TorrentPier is vulnerable to a PHP deserialization flaw in `get_tracks()` function when processing user-controlled cookies, allowing for arbitrary code execution on the system.

CVE-2024-6457 - The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress has a time-based SQL Injection vulnerability allowing unauthenticated attackers to extract sensitive information from the database.

CVE-2024-22442 - The vulnerability could be remotely exploited to bypass authentication.

CVE-2024-39700 - JupyterLab extension template with `copier` test option has an RCE vulnerability in `update-integration-tests.yml` workflow, urging GitHub-hosted extension authors to upgrade to the latest version.

CVE-2024-21181 - The Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) is vulnerable to an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3, IIOP to compromise the server and potentially take over.

Sponsors

SANS

Xona Systems

SANS

Carahsoft

CVE-2024-28751 - An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.

CVE-2024-39872 - SINEMA Remote Connect Server (All versions < V3.2 SP1) allows authenticated attackers with the 'Manage firmware updates' role to escalate privileges via improper assignment of rights to temporary files.

CVE-2024-6611 - A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128.

CVE-2024-39071 - Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.