CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog

• CVE-2024-38812 (9.8 critical) VMware vCenter Server heap-overflow vulnerability
• CVE-2024-38813 (7.5 high) VMware vCenter privilege escalation vulnerability

#cisa #kev #cisakev #knownexploitedvulnerabilitiescatalog #vmware #vcenter #vulnerability #eitw #activeexploitation #infosec #cybersecurity

We’re excited to introduce our new TAXII server and the latest addition to the ATT&CK Workbench software suite: the MITRE ATT&CK Workbench TAXII 2.1 Server:

https://medium.com/mitre-attack/introducing-taxii-2-1-and-a-fond-farewell-to-taxii-2-0-d9fca6ce4c58

What the Bluesky v Mastodon discourse feels like.

New from 404 Media: we've obtained and published the list of iPhone and Android devices secretive phone unlocking tech Graykey was able, or unable, to get data from recently. Unprecedented leak, we've never seen this granularity from Graykey before https://www.404media.co/leaked-documents-show-what-phones-secretive-tech-graykey-can-unlock-2/

I’ve been getting a number of phishing emails purporting to be from Hetzner saying my payment into needs to be updated. It’s interesting excuse they targeting email addresses that are plausibly associated with my various fediverse service domains. The from addresses are nonsensical, and the link to login Hetzner are easy give away that it’s a scam.

Anyhow, please be on alert if you use Hetzner. I am guessing the play here is to steal your Hetzner login credentials, and (probably) payment information. Hetzner does have an alert in their portal about phishing attacks purporting to be from them so I think they are aware, though I found the targeting to be a bit novel.

Stay safe out there.

Can't wait to deploy trippy parrots to our AS/400! #IBMi

https://community.ibm.com/community/user/power/blogs/val-besong/2024/11/12/ibm-power-modernizes-infrastructure-and-accelerate

IBM Power11 is coming, but not announced.
💙 #IBMi #rpgpgm #IBMChampion
https://www.rpgpgm.com/2024/11/ibm-power11-is-coming-but-not-announced.html

[RSS] Remediation for CVE-2024-20767 (ColdFusion) and CVE-2024-21216 (WebLogic) Potential Exploitable Bugs

https://blog.securelayer7.net/coldfusion-path-traversal-and-weblogic-unauthenticated-rce-remediation/

New assessment for topic: CVE-2024-0012

Topic description: "An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . ..."

"Based upon writing a [Metasploit exploit module](https://github.com/rapid7/metasploit-framework/pull/19663) for this exploit chain, I have rated the exploitability of this as very easy, as a target PAN-OS management interface is vulnerable in a default configuration. ..."

Link: https://attackerkb.com/assessments/a360309b-1a6e-424c-961a-f7dfb48113d7

Hello #TROOPERS, we have opened the cfp (https://troopers.de/troopers25/contribute/) and ticket shop for next year's #TROOPERS25! Get your early bird until January 31st. Hope to see you in Heidelberg next near in June and looking forward to all your submissions!

Another externality of half-assed #EU #privacy regulation:

Translated pages become unreadable because you can't click through consent banners (and blockers stop working too) :P

OK this is pretty awesome: thanks to recent advances in machine translation (in large part LLM's), my old blog became magically available English:

https://translate.kagi.com/Hungarian/English/https://buhera.blog.hu/2014/02/22/apple_vs_ssl_goto_fail

We open sourced FastFeedParser, a high performance RSS, Atom and RDF parser in Python: https://github.com/kagisearch/fastfeedparser

This library powers Kagi Small Web (https://github.com/kagisearch/smallweb) and a few other initiatives at Kagi and is 10x-100x faster and more efficient at parsing feeds than existing alternatives!

#Kagi #AdFree #SmallWeb #Python

"The xCyclopedia project attempts to document all executable binaries (and eventually scripts) that reside on a typical operating system."

https://strontic.github.io/xcyclopedia/intro

[oss-security] PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21

https://www.openwall.com/lists/oss-security/2024/11/16/7

CVE-2024-10976, CVE-2024-10977, CVE-2024-10978, CVE-2024-10979

Extracting Plaintext Credentials from Palo Alto Global Protect https://shells.systems/extracting-plaintext-credentials-from-palo-alto-global-protect/

Qualys is at it again:

https://seclists.org/oss-sec/2024/q4/108

LPEs in needrestart (CVE-2024-48990, CVE-2024-48991, CVE-2024-48992,
CVE-2024-10224, and CVE-2024-11003)

Vulnerability names: this is log4shell. We named it this way because it's in log4j and gives you shell.

Threat actor names: this is HAIRY EEL, aka VIOLIN HIPPO, no relation to VEXING MACKEREL. Also known as APT-74, formely APT-C-92. We named it this way because he's a guy in Bulgaria

Thinking of participating in #Pwn2Own Automotive? ZDI's Connor Ford provides a detailed look at the internals of the #Kenwood DMX958XR. This is the first in a series detailing the attack surface of the IVI. Read all the details (and gander at the pics) at https://www.zerodayinitiative.com/blog/2024/11/18/looking-at-the-internals-of-the-kenwood-dmx958xr-ivi

ZDI-24-1514|CVE-2024-11393] (0Day) Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8; Credit: The_Kernel_Panic) https://www.zerodayinitiative.com/advisories/ZDI-24-1514/