#CVE2024

Google’s AI-Powered OSS-Fuzz Tool Finds 26 Vulnerabilities in Open-Source Projects

by

November 21, 2024 at 03:13AM Google’s AI-powered fuzzing tool, OSS-Fuzz, has uncovered 26 vulnerabilities, including a medium-severity flaw in OpenSSL (CVE-2024-9143), indicating significant advancements in automated vulnerability detection. The tool enhances code coverage and is part of Google’s transition to memory-safe languages like Rust, alongside new security checks in C++. **Meeting Takeaways – Nov 21, … Read more

Ubuntu Linux impacted by decade-old ‘needrestart’ flaw that gives root

by

November 20, 2024 at 02:11PM Five local privilege escalation vulnerabilities in Ubuntu’s needrestart utility were discovered by Qualys, tracked as CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003. All were fixed in version 3.8. Attackers with local access could exploit these flaws to gain root privileges. ### Meeting Takeaways: 1. **Vulnerability Overview**: Five local privilege escalation (LPE) … Read more

CISA tags new Progress Kemp LoadMaster flaw as exploited in attacks

by

November 19, 2024 at 04:20PM CISA has added three new critical vulnerabilities to its KEV catalog, including CVE-2024-1212 in Progress Kemp LoadMaster, which allows remote system access. Organizations must implement updates by December 9, 2024, or cease usage. Additionally, another flaw, CVE-2024-7591, has also been identified but lacks observed exploitation. **Meeting Takeaways:** 1. **New Vulnerabilities … Read more

About the security content of visionOS 2.1.1 – Apple Support

by

November 19, 2024 at 02:43PM Apple has addressed two security vulnerabilities in visionOS 2.1.1 for the Apple Vision Pro, with release set for November 19, 2024. CVE-2024-44308 involves potential arbitrary code execution from malicious web content, while CVE-2024-44309 addresses cookie management issues that could lead to cross-site scripting attacks. ### Meeting Notes Takeaways 1. **Upcoming … Read more

About the security content of iOS 18.1.1 and iPadOS 18.1.1 – Apple Support

by

November 19, 2024 at 01:54PM Apple released updates on November 19, 2024, addressing CVE-2024-44308 and CVE-2024-44309, which involved vulnerabilities that could lead to arbitrary code execution and cross-site scripting attacks, respectively. The issues were reported to have been actively exploited on Intel-based Macs and affect iOS and iPadOS 18.1.1 devices. ### Meeting Takeaways **Release Information:** … Read more

About the security content of macOS Sequoia 15.1.1 – Apple Support

by

November 19, 2024 at 01:54PM Apple has addressed two security vulnerabilities in macOS Sequoia 15.1.1 (CVE-2024-44308 and CVE-2024-44309), which involve arbitrary code execution and cross-site scripting attacks, respectively. Both issues may have been actively exploited on Intel-based Mac systems, with updates now available. Release date is November 19, 2024. **Meeting Takeaways:** 1. **Release Information:** – … Read more

About the security content of iOS 17.7.2 and iPadOS 17.7.2 – Apple Support

by

November 19, 2024 at 01:54PM Two vulnerabilities (CVE-2024-44308 and CVE-2024-44309) in iOS 17.7.2 and iPadOS 17.7.2 could allow arbitrary code execution and cross-site scripting attacks, respectively, on Intel-based Macs. Updates are available for various iPhone and iPad models starting from iPhone XS and iPad Air 3rd generation onward. ### Meeting Takeaways **Release Information:** – **Release … Read more

Palo Alto Networks tackles firewall-busting zero-days with critical patches

by

November 19, 2024 at 10:35AM Palo Alto Networks has issued patches for two zero-day vulnerabilities: CVE-2024-0012, a critical authentication bypass, and CVE-2024-9474, a medium-severity privilege escalation. Users are urged to update urgently. The company warns of ongoing exploitation, particularly from VPN services, and advises restricting access to management interfaces. ### Meeting Takeaways: 1. **New Vulnerabilities … Read more

CISA Alert: Active Exploitation of VMware vCenter and Kemp LoadMaster Flaws

by

November 19, 2024 at 02:03AM Recently patched vulnerabilities in Progress Kemp LoadMaster and VMware vCenter Server are being actively exploited. CISA added CVE-2024-1212, a critical flaw, to its Known Exploited Vulnerabilities catalog. Other vulnerabilities in VMware include CVE-2024-38812 and CVE-2024-38813, with remediation recommended by December 9, 2024, for federal agencies. **Meeting Takeaways – November 19, … Read more

Critical 9.8-rated VMware vCenter RCE bug exploited after patch fumble

by

November 18, 2024 at 05:38PM Two VMware vCenter vulnerabilities, CVE-2024-38812 and CVE-2024-38813, have been actively exploited after Broadcom’s patch attempts. CVE-2024-38812 allows remote code execution, while CVE-2024-38813 permits privilege escalation. These flaws affect multiple vCenter and VMware Cloud Foundation versions, making them critical targets for cybercriminals. **Meeting Takeaways:** 1. **Vulnerabilities Identified**: Two critical vulnerabilities in … Read more