Weekly Threat & Vulnerabilities Report

July 12, 2024
Executive Summary
Trending / Critical Vulnerabilities
Exploit Activity and Mass Scanning Observed on Cytellite Sensors
Vulnerabilities abused by Botnet
Vulnerabilities Abused by Malware
PRE-NVD observed for this week
Subscribe to our Reports

Executive Summary

Trending / Critical Vulnerabilities

Current trending vulnerabilities offer insights into the latest emerging and widely discussed threats, helping to make informed decisions.

CVE-IDType of vulnerabilitySeverityCVSSAffected ProductExploited-in-WildEPSS scoreCISA-KEVZero-dayOSS
CVE-2024-38080Privilege EscalationHigh7.8Windows Hyper-VTrue0.00144TrueTrueFalse
CVE-2024-23692Template InjectionCritical9.8Rejetto HTTP File ServerTrue0.02333TrueFalseFalse
CVE-2024-38112Spoofing vulnerabilityHigh8.1Microsoft Windows MSHTML PlatformTrue0.01008TrueTrueFalse
CVE-2024-29510Format String vulnerabilityMedium6.3Artifex GhostscriptTrue0.00129FalseFalseTrue
CVE-2024-5441Arbitrary File UploadHigh8.8Modern Events Calendar pluginTrue0.0005FalseFalseFalse

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

VulnerabilitiesProductSeverityTitleExploited-in-WildCISA KEV
CVE-2023-49103ownCloud graphapiCriticalInformation Disclosure Vulnerability in ownCloud graphapi.TrueTrue
CVE-2023-22527Confluence Data Center and ServerCriticalTemplate injection vulnerability in Out-of-Date Versions of Confluence Data Center and Server leads to remote code executionTrueFalse

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by botnets, including recent CVEs logged in Misp. Presenting the top 5 CVEs with payloads suggestive of botnet activities, like utilizing wget with IP addresses.

VulnerabilityProductTitleExploitAbused by Botnet
CVE-2021-41773Apache HTTP ServerPath traversal vulnerability in Apache HTTP ServerTrueZerobot
CVE-2017-17215Huawei HG532Remote code execution vulnerability in Huawei HG532 routerTrueSysrvbotnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak Sites and more.

VulnerabilitySeverityTitlePatchTargeted By MalwareOSS
CVE-2024-21412HighSecurity Feature Bypass vulnerability in Microsoft Internet Shortcut FilesTrueDarkMe RAT, Meduza stealer, Lumma StealerFalse
CVE-2023-27532HighMissing authentication vulnerability in Veeam Backup & Replication componentTrueEstate RansomwareFalse

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-IDType of vulnerabilityProductReference
CVE-2024-23967Stack-based Buffer OverflowAutel MaxiCharger AC Elite Business C50Resource
CVE-2024-23960Improper Verification of Cryptographic SignatureAlpine Halo9Resource
CVE-2024-23963Stack-based Buffer OverflowAlpine Halo9Resource

Get notified

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Latest Reports

Latest Reports