Vulnerability Risk Management – Noise

CVE-2024-0204: Critical Authentication Bypass in Fortra GoAnywhere MFT

Caitlin Condon — Tue, 23 Jan 2024 18:42:31 +0000

On January 22, 2024, Fortra published a security advisory on CVE-2024-0204, a critical authentication bypass affecting its GoAnywhere MFT secure managed file transfer product prior to version 7.4.1.

Critical CVEs in Outdated Versions of Atlassian Confluence and VMware vCenter Server

Rapid7 — Fri, 19 Jan 2024 15:40:43 +0000

Rapid7 is highlighting two critical vulnerabilities in outdated versions of widely deployed software this week. Atlassian disclosed CVE-2023-22527, a template injection vulnerability in Confluence Server with a maxed-out CVSS score of 10, while VMware pushed a fresh update to its October 2023 vCenter Server advisory on CVE-2023-34048 to note that

Zero-Day Exploitation of Ivanti Connect Secure and Policy Secure Gateways

Caitlin Condon — Thu, 11 Jan 2024 13:00:40 +0000

CVE-2023-46805 and CVE-2024-21887 are zero-day vulnerabilities affecting Ivanti Connect Secure and Ivanti Policy Secure gateways. They have been exploited in the wild to gain access to corporate networks and conduct a range of nefarious activities, including backdooring legitimate files.

We Asked ChatGPT for 2024 Cybersecurity Predictions but You Should Make These Resolutions Instead

Rapid7 — Mon, 18 Dec 2023 16:00:00 +0000

Here at Rapid7 we’ve seen a whole lot of threats and exploited vulnerabilities in 2023, many in the form of zero days. So it can be a little overwhelming to think about what could be in store for us in the year ahead.

CVE-2023-49103 – Critical Information Disclosure in ownCloud Graph API

Stephen Fewer — Fri, 01 Dec 2023 17:19:25 +0000

On November 21, 2023, ownCloud disclosed CVE-2023-49103, an unauthenticated information disclosure vulnerability affecting ownCloud, when a vulnerable extension called “Graph API” (graphapi) is present.

CVE-2023-47246: SysAid Zero-Day Vulnerability Exploited By Lace Tempest

Caitlin Condon — Thu, 09 Nov 2023 14:12:55 +0000

A new zero-day vulnerability (CVE-2023-47246) in SysAid IT service management software is being exploited by the threat group responsible for the MOVEit Transfer attack in May 2023.

Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518

Rapid7 — Mon, 06 Nov 2023 15:31:47 +0000

Daniel Lydon and Conor Quinn contributed attacker behavior insights to this blog.

As of November 5, 2023, Rapid7 Managed Detection and Response (MDR) is observing exploitation of Atlassian Confluence in multiple customer environments, including for ransomware deployment. We have confirmed that at least some of the exploits are targeting CVE-2023-22518

CVE-2023-4966: Exploitation of Citrix NetScaler Information Disclosure Vulnerability

Rapid7 — Wed, 25 Oct 2023 18:18:15 +0000

On October 10, 2023, Citrix published an advisory on two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. The more critical of these is CVE-2023-4966, a sensitive information disclosure vulnerability that allows an attacker to read large amounts of memory after the end of a buffer.

CVE-2023-20198: Active Exploitation of Cisco IOS XE Zero-Day Vulnerability

Caitlin Condon — Tue, 17 Oct 2023 19:50:03 +0000

On Monday, October 16, Cisco’s Talos group published a blog on an active threat campaign exploiting CVE-2023-20198, a “previously unknown” zero-day vulnerability in the web UI component of Cisco IOS XE software.

CVE-2023-22515: Zero-Day Privilege Escalation in Confluence Server and Data Center

Caitlin Condon — Wed, 04 Oct 2023 15:28:53 +0000

On October 4, 2023, Atlassian published a security advisory on CVE-2023-22515, a critical privilege escalation vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center.

Critical Vulnerabilities in WS_FTP Server

Caitlin Condon — Fri, 29 Sep 2023 13:33:05 +0000

On September 27, 2023, Progress Software published a security advisory on multiple vulnerabilities affecting WS_FTP Server, a secure file transfer solution. There are a number of vulnerabilities in the advisory, two of which are critical (CVE-2023-40044 and CVE-2023-42657).

Rapid7 is not aware of any exploitation in the wild as

CVE-2023-42793: Critical Authentication Bypass in JetBrains TeamCity CI/CD Servers

Caitlin Condon — Mon, 25 Sep 2023 17:32:48 +0000

On September 20, 2023, JetBrains disclosed CVE-2023-42793, a critical authentication bypass vulnerability in on-premises instances of their TeamCity CI/CD server. Successful exploitation could make the vulnerability a potential supply chain attack vector.

Active Exploitation of IBM Aspera Faspex CVE-2022-47986

Caitlin Condon — Tue, 28 Mar 2023 19:35:19 +0000

Rapid7 is aware of at least one incident where a customer was compromised via CVE-2022-47986. We strongly recommend patching on an emergency basis.

CVE-2023-22501: Critical Broken Authentication Flaw in Jira Service Management Products

Caitlin Condon — Mon, 06 Feb 2023 16:46:36 +0000

Atlassian has published an advisory for CVE-2023-22501, a critical broken authentication vulnerability affecting Jira service management products.

Ransomware Campaign Compromising VMware ESXi Servers

Caitlin Condon — Mon, 06 Feb 2023 15:00:57 +0000

Hosting provider OVH and French CERT has issued a warning about a ransomware campaign that appears to be using CVE-2021-21974 to target VMware ESXi servers.

Exploitation of GoAnywhere MFT zero-day vulnerability

Caitlin Condon — Fri, 03 Feb 2023 16:18:21 +0000

A warning has been issued about an actively exploited zero-day vulnerability affecting on-premise instances of Fortra’s GoAnywhere MFT.

Rapid7 Added to Carahsoft GSA Schedule Contract

Rapid7 — Tue, 24 Jan 2023 15:00:00 +0000

We are happy to announce that Rapid7 has been added to Carahsoft’s GSA Schedule contract, making our suite of comprehensive security solutions widely available to Federal, State, and Local agencies through Carahsoft and its reseller partners.

CVE-2022-3786 and CVE-2022-3602: Two High-Severity Buffer Overflow Vulnerabilities in OpenSSL Fixed

Rapid7 — Tue, 01 Nov 2022 16:38:53 +0000

The Rapid7 research team will update this blog post as we learn more details about this vulnerability and its attack surface area. We expect to update this page next by 3 PM EDT on November 1, 2022.

The OpenSSL project released version 3.0.7 on November 1, 2022, to

CVE-2021-39144: VMware Cloud Foundation Unauthenticated Remote Code Execution

Caitlin Condon — Thu, 27 Oct 2022 15:22:09 +0000

On October 25, 2022, VMware published VMSA-2022-0027 on two vulnerabilities in its Cloud Foundation solution. By far the more severe of these is CVE-2021-39144, an unauthenticated remote code execution vulnerability with a CVSSv3 score of 9.8.

CVE-2022-42889: Keep Calm and Stop Saying “4Shell”

Erick Galinkin — Mon, 17 Oct 2022 20:36:16 +0000

CVE-2022-42889, which some have begun calling “Text4Shell,” is a vulnerability in the popular Apache Commons Text library that can result in code execution when processing malicious input. The vulnerability was announced on October 13, 2022 on the Apache dev list. CVE-2022-42889 arises from insecure implementation of Commons Text’s variable