CVE-2024-8595

A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-8589

A maliciously crafted SLDPRT file when parsed in odxswdll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-7991 Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution Vulnerability

A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the curre...

CVE-2024-9997

Autodesk AutoCAD is affected by CVE-2024-9997 due to a vulnerability in acdb25.dll when parsing a malicious DWG file, causing memory corruption that can crash the process or allow arbitrary code execution. The issue is detailed across multiple feeds (NVD, Red Hat, CIRCL, ZDI) with the impact desc...

CVE-2024-9489

CVE-2024-9489 involves Autodesk AutoCAD where parsing a malicious DWG file in ACAD.exe can trigger a memory corruption vulnerability. The description and related sources indicate possible outcomes include a crash, reading/writing sensitive data, or arbitrary code execution within the process cont...

CVE-2024-8592

CVE-2024-8592 affects Autodesk AutoCAD via the AcTranslators.exe CATPART parser. The issue is a memory corruption vulnerability in CATPART handling that can crash the process, leak data, or allow arbitrary code execution in the current process. Exploitation requires user interaction (e.g., openin...

CVE-2024-8587

A maliciously crafted SLDPRT file when parsed in odxswdll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-8596

Summary: CVE-2024-8596 affects Autodesk AutoCAD via parsing of MODEL files in the libodxdll.dll component, causing an Out-of-Bounds Write that can crash, corrupt data, or allow arbitrary code execution. Documentation from ZDI indicates remote code execution is possible if a user opens a malicious...

CVE-2024-8593

CVE-2024-8593 affects Autodesk AutoCAD via parsing a CATPART file with ASMKERN230A.dll, causing an Out-of-Bounds Write. Public sources describe potential to crash, corrupt data, or execute code in the current process. The CVE has a high severity (CVSS v3.1: 7.8) with LOCAL attack vector and user ...

CVE-2024-8590 Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution Vulnerability

A maliciously crafted 3DM file when parsed in atfapi.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-8589

CVE-2024-8589 affects Autodesk AutoCAD via parsing of SLDPRT files in the odxsw_dll.dll. The issue is described as an Out-of-Bounds Read vulnerability that can crash the process, disclose sensitive data, or allow arbitrary code execution in the current process. Public references (NVD, Red Hat, ZD...

Chinese Hackers Use CloudScout Toolset to Steal Session Cookies from Cloud Services

A government entity and a religious organization in Taiwan were the target of a China-linked threat actor known as Evasive Panda that infected them with a previously undocumented post-compromise toolset codenamed CloudScout. "The CloudScout toolset is capable of retrieving data from various cloud...

CVE-2024-42028

A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...

CERT-UA Identifies Malicious RDP Files in Latest Attack on Ukrainian Entities

The Computer Emergency Response Team of Ukraine CERT-UA has detailed a new malicious email campaign targeting government agencies, enterprises, and military entities. "The messages exploit the appeal of integrating popular services like Amazon or Microsoft and implementing a zero-trust...

CVE-2024-10386

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation...

Cisco Releases Security Bundle for Cisco ASA, FMC, and FTD Software

Cisco released its October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication to address vulnerabilities in Cisco ASA, FMC, and FTD. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users an...

Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a now-patched security flaw in Google Chrome to seize control of infected devices. Cybersecurity vendor Kaspersky said it made the discovery after it came across a novel attack chain in May 20...

Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Cisco Talos recently discovered a phishing campaign using an open-source phishing toolkit called Gophish by an unknown threat actor. The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim's intervention to trigger the infection chain...

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

We observed an unknown threat actor abusing exposed Docker remote API servers to deploy the perfctl malware...

Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant

The Russian threat actor known as RomCom has been linked to a new wave of cyber attacks aimed at Ukrainian government agencies and unknown Polish entities since at least late 2023. The intrusions are characterized by the use of a variant of the RomCom RAT dubbed SingleCamper aka SnipBot or RomCom...