InfoSecBulletin Cybersecurity for mankind
SolarWinds released updates to fix several security issues in Serv-U and the SolarWinds Platform. These vulnerabilities impact Platform 2024.1 SR 1 and older versions. The company fixed a security issue, known as CVE-2024-28996, reported by a penetration tester from NATO.
NATO Communications and Information Agency pentester Nils Putnins discovered a SQL flaw called CVE-2024-28996 with a CVSS score of 7.5. It allows users to query the SolarWinds database for network information. The attack complexity is high.
Brain Cipher Ransomware to Release Decryption Keys free for Indonesia
0-click Account Takeover via Google Authentication
multiple vulnerabilities found in apache HTTP server
Australian four major banks raised alarm on cyber ‘warfare’
CVE-2024-20399: Cisco NX-OS Vulnerability Under active Attack
NCSA to do maximum work with limited manpower: DG Kamruzzaman
Microsoft Issues CVE Numbers for Cloud Service Vulnerabilities
Ransomware detail behind Indonesia’s data center breach
MerkSpy Exploits Microsoft Office Vulnerability: FortiGuard report
Google Blocking Entrust Certificates in Chrome in November 2024
The company also addressed multiple vulnerabilities in third-party companies. The flaws, tracked as CVE-2024-28999 (CVSS score 6.4) and CVE-2024-29004 (CVSS score 7.1), are a race condition issue and a stored XSS bug in the web console, respectively.
The company fixed multiple bugs in third-party components, such as Angular, the public API function BIO_new_NDEF, the OpenSSL RSA Key generation algorithm, and the x86_64 Montgomery squaring procedure in OpenSSL.
The company fixed the vulnerabilities in version 2024.2. SolarWinds released Serv-U 15.4.2 Hotfix 2, which works on Windows and Linux OS, both 32-bit and 64-bit. Admins are advised to update their Serv-U instances as soon as possible.
There’s no report of the bug being used, but attackers have exploited Serv-U vulnerabilities, including zero-days.
