InfoSecBulletin Cybersecurity for mankind
CISA has issued an alert about three critical security vulnerabilities that are currently being exploited. These issues are now part of CISA’s Known Exploited Vulnerabilities (KEV) catalog and require urgent action from organizations and individuals to avoid potential risks.
Vulnerability Breakdown:
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
CVE-2023-45727 (CVSS 7.5): A vulnerability in Proself Enterprise/Standard Edition, Proself Gateway Edition, and Proself Mail Sanitize Edition (versions before 5.63, 1.66, and 1.08) allows remote, unauthenticated attackers to perform XML External Entity (XXE) attacks. Exploiting this could give them unauthorized access to sensitive account information on affected servers.
CVE-2024-11680 (CVSS 9.8): A critical vulnerability in ProjectSend (versions before r1720) allows remote, unauthenticated attackers to alter the application’s settings through specially crafted HTTP requests. This can result in unauthorized account creation, web shell uploads, and malicious JavaScript injection, giving attackers control over compromised systems. Public exploits, including Nuclei templates and Metasploit modules, have led to widespread exploitation. Research from Vulncheck shows that 99% of ProjectSend instances are still vulnerable, with active exploitation noted since September. Censys reported 4,026 publicly accessible ProjectSend instances, mostly (40%) in the United States, and about 9% using CloudFlare’s infrastructure.
CVE-2024-11667 (CVSS 7.5): A directory traversal vulnerability affects Zyxel ATP, USG FLEX, and USG20(W)-VPN series firmware versions V5.00 to V5.38. It allows attackers to download or upload files via specially crafted URLs, risking sensitive data and system integrity. This vulnerability is associated with the Helldown ransomware, particularly impacting German organizations.
CISA’s Call to Action:
CISA advises all users and organizations to quickly patch affected systems to reduce risks from actively exploited vulnerabilities. Federal Civilian Executive Branch agencies have until December 24, 2024, to apply these patches to protect their networks.
