InfoSecBulletin Cybersecurity for mankind
CISA has issued an alert about three critical security vulnerabilities that are currently being exploited. These issues are now part of CISA’s Known Exploited Vulnerabilities (KEV) catalog and require urgent action from organizations and individuals to avoid potential risks.
Vulnerability Breakdown:
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
CVE-2023-45727 (CVSS 7.5): A vulnerability in Proself Enterprise/Standard Edition, Proself Gateway Edition, and Proself Mail Sanitize Edition (versions before 5.63, 1.66, and 1.08) allows remote, unauthenticated attackers to perform XML External Entity (XXE) attacks. Exploiting this could give them unauthorized access to sensitive account information on affected servers.
CVE-2024-11680 (CVSS 9.8): A critical vulnerability in ProjectSend (versions before r1720) allows remote, unauthenticated attackers to alter the application’s settings through specially crafted HTTP requests. This can result in unauthorized account creation, web shell uploads, and malicious JavaScript injection, giving attackers control over compromised systems. Public exploits, including Nuclei templates and Metasploit modules, have led to widespread exploitation. Research from Vulncheck shows that 99% of ProjectSend instances are still vulnerable, with active exploitation noted since September. Censys reported 4,026 publicly accessible ProjectSend instances, mostly (40%) in the United States, and about 9% using CloudFlare’s infrastructure.
CVE-2024-11667 (CVSS 7.5): A directory traversal vulnerability affects Zyxel ATP, USG FLEX, and USG20(W)-VPN series firmware versions V5.00 to V5.38. It allows attackers to download or upload files via specially crafted URLs, risking sensitive data and system integrity. This vulnerability is associated with the Helldown ransomware, particularly impacting German organizations.
CISA’s Call to Action:
CISA advises all users and organizations to quickly patch affected systems to reduce risks from actively exploited vulnerabilities. Federal Civilian Executive Branch agencies have until December 24, 2024, to apply these patches to protect their networks.
