Weekly Threat & Vulnerabilities Report

July 19, 2024
Executive Summary
Trending / Critical Vulnerabilities
Exploit Activity and Mass Scanning Observed on Cytellite Sensors
Vulnerabilities abused by Botnet
Vulnerabilities Abused by Malware
PRE-NVD observed for this week
Subscribe to our Reports

Executive Summary

Trending / Critical Vulnerabilities

Current trending vulnerabilities offer insights into the latest emerging and widely discussed threats, helping to make informed decisions.

CVE-IDType of vulnerabilitySeverityCVSSAffected ProductExploited-in-WildEPSS scoreCISA-KEVZero-dayOSS
CVE-2024-36401Remote code executionCritical9.8GeoServerTrue0.94638TrueFalseTrue
CVE-2024-28995Path TraversalHigh8.6SolarWinds Serv-UTrue0.96002TrueFalseFalse
CVE-2024-34102Improper Restriction of XML External EntityCritical9.8Adobe CommerceTrue0.9708TrueFalseTrue
CVE-2022-22948Information disclosureMedium6.5vCenter ServerTrue0.00777TrueFalseFalse

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

VulnerabilitiesProductSeverityTitleExploited-in-WildCISA KEV
CVE-2024-4577PHP-CGI on WindowsCriticalCritical argument injection vulnerability in PHP on Windows serversTrueTrue
CVE-2024-3273D-Link NAS devicesCriticalCommand Injection Vulnerability in D-Link NAS devicesTrueTrue

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by botnets, including recent CVEs logged in Misp. Presenting the top 5 CVEs with payloads suggestive of botnet activities, like utilizing wget with IP addresses.

VulnerabilityProductTitleExploitAbused by Botnet
CVE-2021-41773Apache HTTP ServerPath traversal vulnerability in Apache HTTP ServerTrueZerobot
CVE-2016-20016MVPower CCTV DVR modelsRemote code execution vulnerability in MVPower CCTVDVR modelsTrueIoT-Repear

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak Sites and more.

VulnerabilitySeverityTitlePatchTargeted By MalwareOSS
CVE-2024-38112HighSpoofing vulnerability in Microsoft Windows MSHTML PlatformTrueDonut loader, Atlantida stealer, Void Banshee'sFalse

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-IDType of vulnerabilityProductReference
CVE-2024-24737Denial-of-ServiceSilicon Labs Gecko OSResource
CVE-2024-24731Stack-based Buffer OverflowSilicon Labs Gecko OSResource
CVE-2024-23938Stack-based Buffer OverflowSilicon Labs Gecko OSResource

Get notified

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Latest Reports

Latest Reports