InfoSecBulletin Cybersecurity for mankind
CISA has issued an alert about three critical security vulnerabilities that are currently being exploited. These issues are now part of CISA’s Known Exploited Vulnerabilities (KEV) catalog and require urgent action from organizations and individuals to avoid potential risks.
Vulnerability Breakdown:
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
CVE-2023-45727 (CVSS 7.5): A vulnerability in Proself Enterprise/Standard Edition, Proself Gateway Edition, and Proself Mail Sanitize Edition (versions before 5.63, 1.66, and 1.08) allows remote, unauthenticated attackers to perform XML External Entity (XXE) attacks. Exploiting this could give them unauthorized access to sensitive account information on affected servers.
CVE-2024-11680 (CVSS 9.8): A critical vulnerability in ProjectSend (versions before r1720) allows remote, unauthenticated attackers to alter the application’s settings through specially crafted HTTP requests. This can result in unauthorized account creation, web shell uploads, and malicious JavaScript injection, giving attackers control over compromised systems. Public exploits, including Nuclei templates and Metasploit modules, have led to widespread exploitation. Research from Vulncheck shows that 99% of ProjectSend instances are still vulnerable, with active exploitation noted since September. Censys reported 4,026 publicly accessible ProjectSend instances, mostly (40%) in the United States, and about 9% using CloudFlare’s infrastructure.
CVE-2024-11667 (CVSS 7.5): A directory traversal vulnerability affects Zyxel ATP, USG FLEX, and USG20(W)-VPN series firmware versions V5.00 to V5.38. It allows attackers to download or upload files via specially crafted URLs, risking sensitive data and system integrity. This vulnerability is associated with the Helldown ransomware, particularly impacting German organizations.
CISA’s Call to Action:
CISA advises all users and organizations to quickly patch affected systems to reduce risks from actively exploited vulnerabilities. Federal Civilian Executive Branch agencies have until December 24, 2024, to apply these patches to protect their networks.
