New assessment for topic: ProxyShell Exploit Chain

Topic description: "ProxyShell is an exploit chain targeting on-premise installations of Microsoft Exchange Server ..."

"CISA released an updated advisory on the BianLian ransomware group including the vulnerabilities the group is using to gain initial access towards victims ..."

Link: https://attackerkb.com/assessments/db8969a7-5ae8-4bb3-b216-75154007e43d

New assessment for topic: CVE-2022-37969

Topic description: "Windows Common Log File System Driver Elevation of Privilege Vulnerability ..."

"The vulnerability arises due to insufficient input validation in the CLFS driver ..."

Link: https://attackerkb.com/assessments/a5c63bcc-384c-4087-ae42-f0d4f6b7c928

New assessment for topic: CVE-2024-0012

Topic description: "An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . ..."

"Based upon writing a [Metasploit exploit module](https://github.com/rapid7/metasploit-framework/pull/19663) for this exploit chain, I have rated the exploitability of this as very easy, as a target PAN-OS management interface is vulnerable in a default configuration. ..."

Link: https://attackerkb.com/assessments/a360309b-1a6e-424c-961a-f7dfb48113d7

New assessment for topic: CVE-2024-0012

Topic description: "PAN-OS: Authentication Bypass in the Management Web Interface. ..."

"[metadata only] ..."

Link: https://attackerkb.com/assessments/3f5764fd-48d8-457f-8f38-7b8b3e9abedf

New assessment for topic: CVE-2024-49033

Topic description: "Microsoft Word Security Feature Bypass Vulnerability ..."

"This is a 0-day vulnerability because Microsoft still can not do anything against this nonsense to input a VBS programming language into the Word program - macros options. ..."

Link: https://attackerkb.com/assessments/0fe35db1-a90b-42da-b122-f2e47bd71715

New assessment for topic: CVE-2024-28397

Topic description: "An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. ..."

"Js2py is JavaScript to Python Translator & JavaScript interpreter written in 100% pure Python ..."

Link: https://attackerkb.com/assessments/b261765e-246e-4ceb-8a0f-67610c79af41

New assessment for topic: CVE-2024-39205

Topic description: "An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request. ..."

"[Pyload](https://pyload.net/) is an open-source download manager designed to automate file downloads from various online sources ..."

Link: https://attackerkb.com/assessments/d1af15aa-3339-42d1-a5d3-460d43b3231a

New assessment for topic: CVE-2024-6531

Topic description: "A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks ..."

"Because this vulnerability only arises when the carousel is in use, and we can control the href attribute, the rating was given to be lower than usual ..."

Link: https://attackerkb.com/assessments/5f27a626-82f0-4b5b-bb96-677bb459b725

New assessment for topic: CVE-2022-1040

Topic description: "An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. ..."

"There was good reason to mark attacker value and exploitability as being lower for this bug a few years back, since these firewalls auto-updated for most organizations and not many details were publicly available upon disclosure in 2022 ..."

Link: https://attackerkb.com/assessments/78b6d29d-7c3c-4eef-8f38-c1c62d6dc523

New assessment for topic: CVE-2023-4220

Topic description: "Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. ..."

"Chamilo LMS is a free software e-learning and content management system ..."

Link: https://attackerkb.com/assessments/bf6c1ddd-3805-4e8e-89ed-eecd9feb237b

New assessment for topic: CVE-2024-8069

Topic description: "Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server ..."

"On November 12, 2024, Citrix published [an advisory](https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069) for an unsafe deserialization bug affecting the Citrix Session Recording software from the Citrix Virtual Apps and Desktops product ..."

Link: https://attackerkb.com/assessments/92f22b7b-ec2b-4fa4-9f26-4ff6fea1a6a4

New Rapid7 Analysis on AttackerKB topic: CVE-2024-47575

"On October 23, 2024, Fortinet published an [advisory](https://www.fortiguard.com/psirt/FG-IR-24-423) for [CVE-2024-47575](https://www.rapid7.com/blog/post/2024/10/23/etr-fortinet-fortimanager-cve-2024-47575-exploited-in-zero-day-attacks/), a missing authentication vulnerability affecting FortiManager and FortiManager Cloud devices ..."

Link: https://attackerkb.com/topics/233a6e31-b2a2-400c-94a9-20c1a3297683

New assessment for topic: CVE-2024-9464

Topic description: "An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. ..."

"Note: While this is an authenticated exploit, CVE-2024-5910 affects the same versions and allows an attacker to reset the admin password to allow authentication. ..."

Link: https://attackerkb.com/assessments/911948de-467d-4804-b97d-d943203fae60

New assessment for topic: CVE-2024-5910

Topic description: "Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. ..."

"This is a vulnerability in the password reset of the Palo Alto Expedition web server, and is disturbingly simple ..."

Link: https://attackerkb.com/assessments/ad9409b6-bb16-492b-8392-b8a44c5e3021

New assessment for topic: CVE-2024-34102

Topic description: "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution ..."

"Note: This write up will focus on the impact that CVE-2024-34102 can have when combined with CVE-2024-2961 and how the two bugs can be used to achieve RCE ..."

Link: https://attackerkb.com/assessments/fd4b6425-8316-441d-bd58-b14f022873c9

New assessment for topic: CVE-2024-35250

Topic description: "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability ..."

"The ks.sys driver on Windows is one of the core components of Kernel Streaming and is installed by default ..."

Link: https://attackerkb.com/assessments/b966571c-c90a-4055-af54-ee6af8389f53

New assessment for topic: CVE-2024-37404

Topic description: "Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. ..."

"Ivanti Connect Secure versions prior to 22.7R2.1 and 22.7R2.2, and Ivanti Policy Secure versions prior to 22.7R1 are vulnerable to [CRLF injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection), which leads to remote code execution with the privileges of the user `root` ..."

Link: https://attackerkb.com/assessments/34ea5769-e0d6-4c65-bfc3-510c679ef515

New assessment for topic: CVE-2024-47575

Topic description: "A missing authentication for critical function vulnerability in Fortinet's FortiManager fgfmd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. ..."

"The flaw lies in the FortiGate to FortiManager Protocol (FGFM), which is designed for deployment scenarios where NAT traversal is needed ..."

Link: https://attackerkb.com/assessments/89ecce82-7a39-4376-82e1-8f5bfaad47f6

New assessment for topic: CVE-2022-3405

Topic description: "Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent ..."

"[metadata only] ..."

Link: https://attackerkb.com/assessments/d1b91dad-cf7b-440a-bcec-69d9332d95ff

New assessment for topic: CVE-2022-30995

Topic description: "Sensitive information disclosure due to improper authentication ..."

"[metadata only] ..."

Link: https://attackerkb.com/assessments/5b2f7148-394b-4035-8e70-f9d3d6eb0737