Metasploit Weekly Wrap-Up: 11/15/2024

Palo Alto Expedition RCE module This week's release includes an exploit module for the Palo Alto Expedition exploit chain that's been making headlines recently. The first vulnerability, CVE-2024-5910, allows attackers to reset the password of the admin user. The second vulnerability, CVE-2024-946...

CVE-2023-20093

creationtimestamp| type| source ---|---|--- 2024-11-15 15:16:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113487629823715813...

CVE-2021-3742

creationtimestamp| type| source ---|---|--- 2024-11-15 10:54:16+00:00| seen| https://infosec.exchange/users/cve/statuses/113486597712148555 2024-11-15 13:15:51+00:00| seen| https://t.me/cvedetector/11073 2026-07-03 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpr6v46ffi23...

Fedora 37 : woff (2022-c30d362ce5)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c30d362ce5 advisory. Fix a possible double free in woffEncode. - Update License to SPDX - improved summary and description - Add hand-written man pages - Install HTML format...

CVE-2024-50826

creationtimestamp| type| source ---|---|--- 2024-11-14 17:29:25+00:00| seen| https://infosec.exchange/users/cve/statuses/113482489178632663 2024-11-14 17:32:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113482501269576658...

CVE-2024-50837

creationtimestamp| type| source ---|---|--- 2024-11-14 15:04:35+00:00| seen| https://infosec.exchange/users/cve/statuses/113481919699228585 2024-11-14 16:39:39+00:00| seen| https://t.me/cvedetector/10963...

CVE-2021-21106

creationtimestamp| type| source ---|---|--- 2024-11-14 06:10:09+00:00| seen| MISP/04f708e2-47b6-4fd4-997c-c34be6ce1aa6...

CVE-2018-12533

creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:23+00:00| seen| MISP/0ae5117a-c3f7-4b9f-97b5-d2b54144ee1e 2025-11-25 03:00:13+00:00| published-proof-of-concept| Telegram/cQbTgpKMUqE7r50TMi-Jo6XMKFA-M4NuOONOoKLBjTRKKPs...

cockpit security update

323.1-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in cockpit Orabug: 34030494 - Update documentation links Orabug: 30271413, Orabug: 32013095,...

Fedora 37 : python3-docs / python3.11 (2022-dbb811d203)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-dbb811d203 advisory. Update to 3.11.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 37 : python-m2r / python-mistune / python-mistune08 / etc (2022-e4f5866111)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-e4f5866111 advisory. - updates mistune to 2.0.4 - m2r updated to pin dependency to mistune 2 - new package: python-mistune08 compatibility package, to be used by dependents that...

CVE-2024-21850

creationtimestamp| type| source ---|---|--- 2024-11-13 20:39:17+00:00| seen| https://infosec.exchange/users/cve/statuses/113477573493850683...

CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

CVE-2024-50313

creationtimestamp| type| source ---|---|--- 2024-11-12 14:06:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113470368581389996 2024-11-12 14:41:39+00:00| seen| https://t.me/cvedetector/10605 2024-11-14 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-...

GO-2024-3250 Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt

Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt...

kernel: PM / devfreq: Fix buffer overflow in trans_stat_show

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in transstatshow Fix buffer overflow in transstatshow. Convert simple snprintf to the more secure scnprintf with size of PAGESIZE. Add condition checking if we are exceeding PAGESIZE and exit ear...

ALSA-2024:9190 Moderate: python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

CVE-2024-50230

creationtimestamp| type| source ---|---|--- 2024-11-09 11:19:35+00:00| seen| https://infosec.exchange/users/cve/statuses/113452723368145362...

Security update for python311

This update for python311 fixes the following issues: CVE-2024-9287: Fixed quoted path names provided when creating a virtual environment bsc1232241. Bug fixes: Drop .pyc files from docdir for reproducible builds bsc1230906. Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2024-10668

creationtimestamp| type| source ---|---|--- 2024-11-07 15:29:53+00:00| seen| https://infosec.exchange/users/cve/statuses/113442382992604234 2024-11-07 17:46:20+00:00| seen| https://t.me/cvedetector/10097 2025-04-03 06:21:00+00:00| seen|...