CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

Today, CISA released Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a U.S. Critical Infrastructure Sector Organization in coordination with the assessed organization. This cybersecurity advisory details lessons learned and key findings from an assessment, including the Red...

CVE-2024-8525

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-01 2024-11-21 15:34:18+00:00| seen| https://infosec.exchange/users/cve/statuses/113521672720175626...

CVE-2024-8526

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-01 2024-11-21 15:34:18+00:00| seen| https://infosec.exchange/users/cve/statuses/113521672736384648...

CVE-2024-45369

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07...

CVE-2024-47138

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07...

CVE-2024-52034

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07 2024-11-29 17:24:58+00:00| seen| https://t.me/icscert/968...

CVE-2024-47407

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07 2025-02-11 08:32:04+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/mypromgrcmd.rb 2025-02-11...

CVE-2024-50054

creationtimestamp| type| source ---|---|--- 2024-11-21 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07...

OSCAT Basic Library

RISK EVALUATION Successful exploitation of this vulnerability allows an local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected service. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-38812link is external VMware vCenter Server Heap-Based Buffer Overflow Vulnerability CVE-2024-38813link is external VMware vCenter Server Privilege Escalation...

2024 CWE Top 25 Most Dangerous Software Weaknesses

The Cybersecurity and Infrastructure Security Agency CISA, in collaboration with the Homeland Security Systems Engineering and Development Institute HSSEDI, operated by MITRE, has released the 2024 CWE Top 25 Most Dangerous Software Weaknesseslink is external. This annual list identifies the most...

About Remote Code Execution – FortiManager “FortiJump” (CVE-2024-47575) vulnerability

About Remote Code Execution - FortiManager "FortiJump" CVE-2024-47575 vulnerability. FortiManager is a centralized solution for configuring, enforcing policies, updating, and monitoring Fortinet network devices. The vulnerability was released on October 23. A missing authentication for critical...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on November 19, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-324-01 Mitsubishi Electric MELSEC iQ-F Series CISA encourages users and administrators ...

On November 13, NIST NVD finally admitted the obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year (September 30)

On November 13, NIST NVD finallyadmittedthe obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year September 30. This is actually visible in their own statistics. At the moment, there are 19860 identifiers in the backlog. This week, 1136 new CVEs were...

CVE-2024-8403

creationtimestamp| type| source ---|---|--- 2024-11-19 05:59:25+00:00| seen| https://infosec.exchange/users/cve/statuses/113508087562575659 2024-11-19 08:26:58+00:00| seen| https://t.me/cvedetector/11434 2024-11-19 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-...

GeoVision GV-ADR2701 Improper Authentication (CVE-2023-3638)

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

CVE-2024-52567

creationtimestamp| type| source ---|---|--- 2024-11-18 19:03:40+00:00| seen| https://t.me/cvedetector/11361 2024-11-19 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1525/ 2024-12-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-09...

CVE-2024-52566

creationtimestamp| type| source ---|---|--- 2024-11-18 19:03:40+00:00| seen| https://t.me/cvedetector/11360 2024-11-19 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1524/ 2024-12-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-09...

CVE-2024-52571

creationtimestamp| type| source ---|---|--- 2024-11-18 19:03:37+00:00| seen| https://t.me/cvedetector/11357 2024-11-19 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1526/ 2024-12-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-09...

CVE-2024-52569

creationtimestamp| type| source ---|---|--- 2024-11-18 19:03:35+00:00| seen| https://t.me/cvedetector/11355 2024-11-19 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1521/ 2024-12-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-09...