Recent comments

• INCIDENT: Threat Actors Currently Mass-Exploiting Cleo Servers (0-day-ish) 👾

https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

On December 3, Huntress identified an emerging threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. We’ve directly observed evidence of threat actors exploiting this software en masse and performing post-exploitation activity. Although Cleo published an update and advisory for CVE-2024-50623—which allows unauthenticated remote code execution—Huntress security researchers have recreated the proof of concept and learned the patch does not mitigate the software flaw.

‍TL;DR - This vulnerability is being actively exploited in the wild and fully patched systems running 5.8.0.21 are still exploitable. We strongly recommend you move any internet-exposed Cleo systems behind a firewall until a new patch is released.

• CVE-2024-36401 GeoServer Remote Code Execution - https://github.com/0x0d3ad/CVE-2024-36401

• Kritische Sicherheitslücke in Laravel Framework - Updates verfügbar
• Critical Laravel Flaw (CVE-2024-52301) Exposes Millions of Web Applications to Attack

• Rapid7 Analysis of CVE-2024-47575

« Nov 05, 2024 Ravie LakshmananMobile Security / Vulnerability Vulnerability in Android System

Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to "Android/data," "Android/obb," and "Android/sandbox" directories, and their respective sub-directories, according to a code commit message.»

Android Security Bulletin November 2024

• https://github.com/bartfroklage/CVE-2024-37383-POC

• https://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html

We still see exploitation of that vulnerability in a black-hole network.

• Stable Channel Update for Desktop

CVE-2024-10826: Use after free in Family Experiences. Reported by Anonymous on 2024-09-29

• Chrome release - Stable Channel Update for Desktop

High CVE-2024-10827: Use after free in Serial. Reported by Anonymous on 2024-10-23

we’re back, and despite all the buzz about FortiManager - the saga is about to continue.

Please, remove this from the Internet *even if fully patched*

speak soon.

Ref: https://x.com/watchtowrcyber/status/1853262240822276534