InfoSecBulletin Cybersecurity for mankind
CISA has urgent warnings for organizations regarding three security flaws in Mitel and Oracle systems that are currently being exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog and pose major risks to federal agencies and businesses.
Two vulnerabilities impact Mitel MiCollab, a widely used unified communications platform for businesses.
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
CVE-2024-41713 (CVSS 9.1): This vulnerability in critical path traversal lets attackers access MiCollab servers without authentication, risking sensitive information and possible administrative control.
CVE-2024-55550 (CVSS 4.4): This vulnerability requires admin privileges but lets attackers read local files on the MiCollab server. When combined with CVE-2024-41713, it increases the risk, allowing access to arbitrary files and system compromise.
Mitel urges users to upgrade to MiCollab 9.8 SP2 (9.8.2.12) or later to address vulnerabilities with released updates and patches.
The third vulnerability, CVE-2020-2883 (CVSS 9.8), affects Oracle WebLogic Server. This critical flaw enables unauthenticated attackers to take control of the server remotely, risking data breaches, service disruptions, and malware infections.
CISA has required all Federal Civilian Executive Branch agencies to fix this vulnerability by January 28, 2025, highlighting its urgency.
