SysAdmin 24x7

Microsoft Dynamics 365 Elevation of Privilege Vulnerability CVE-2024-38182 Security Vulnerability Released: Jul 31, 2024 Description Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38182 https://www.cve.org/CVERecord?id=CVE-2024-38182

STARGAZERS GHOST NETWORK Introduction Threat actors continually evolve their tactics to stay ahead of detection. Traditional methods of malware distribution via emails containing malicious attachments are heavily monitored, and the general public has become more aware of these tactics. Recently, Check Point Research observed threat actors using GitHub to achieve initial infections by utilizing new methods. Previously, GitHub was used to distribute malicious software directly, with a malicious script downloading either raw encrypted scripting code or malicious executables. https://research.checkpoint.com/2024/stargazers-ghost-network/

Docker fixes critical 5-year old authentication bypass flaw Docker has issued security updates to address a critical vulnerability impacting certain versions of Docker Engine that could allow an attacker to bypass authorization plugins (AuthZ) under certain circumstances. https://www.bleepingcomputer.com/news/security/docker-fixes-critical-5-year-old-authentication-bypass-flaw/

Vulnerabilities in LangChain Gen AI Researchers from Palo Alto Networks have identified two vulnerabilities in LangChain, a popular open source generative AI framework with over 81,000 stars on GitHub https://unit42.paloaltonetworks.com/langchain-vulnerabilities/

Múltiples vulnerabilidades en Endpoint Manager para Mobile de Ivanti Fecha 23/07/2024 Importancia 5 - Crítica Recursos Afectados Endpoint Manager for Mobile: versiones anteriores a 11.12.0.3, 12.0.0.3 and 12.1.0.1. Descripción Ivanti ha publicado 4 vulnerabilidades: 1 de severidad crítica, 2 altas y una media. La explotación de estas vulnerabilidades podría permitir fuga de información, acceso a recursos y ejecución de código. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-endpoint-manager-para-mobile-de-ivanti

REMEDIATION AND GUIDANCE HUB: FALCON CONTENT UPDATE FOR WINDOWS HOSTS Page last updated 2024-07-24 0335 UTC https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/

Pantalla Azul de la Muerte, Empresas de Todo el Mundo Afectadas por Error de CrowdStrike https://unaaldia.hispasec.com/2024/07/pantalla-azul-de-la-muerte-empresas-de-todo-el-mundo-afectadas-por-error-de-crowdstrike.html?utm_source=rss&utm_medium=rss&utm_campaign=pantalla-azul-de-la-muerte-empresas-de-todo-el-mundo-afectadas-por-error-de-crowdstrike

CCN-CERT AV 12/24 Indisponibilidad de equipos Windows por fallo en el agente Falcon de CrowdStrike https://www.ccn-cert.cni.es/es/seguridad-al-dia/avisos-ccn-cert/12981-ccn-cert-av-12-24-indisponibilidad-de-equipos-windows-por-fallo-en-el-agente-falcon-de-crowdstrike.html

Actualizaciones críticas en Oracle (julio 2024) Fecha 17/07/2024 Importancia 5 - Crítica Recursos Afectados https://www.incibe.es/incibe-cert/alerta-temprana/avisos/actualizaciones-criticas-en-oracle-julio-2024

Cisco Secure Email Gateway Arbitrary File Write Vulnerability Advisory ID: cisco-sa-esa-afw-bGG2UsjH First Published: 2024 July 17 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCwj53998 CVE-2024-20401 CWE-36 CVSS Score: Base 9.8 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-bGG2UsjH

Cisco SSM On-Prem bug lets hackers change any user's password Cisco has fixed a maximum severity vulnerability that allows attackers to change any user's password on vulnerable Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers, including administrators. The flaw also impacts SSM On-Prem installations earlier than Release 7.0, known as Cisco Smart Software Manager Satellite (SSM Satellite). https://www.bleepingcomputer.com/news/security/cisco-ssm-on-prem-bug-lets-hackers-change-any-users-password/

2024-07 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 24.1R1 release Article IDJSA83026Created2024-07-10 Multiple vulnerabilities have been resolved in the Juniper Networks Junos Space 24.1R1 release by updating third party software included with Junos Space. These issues affect Juniper Networks Junos Space versions prior to 24.1R1. https://supportportal.juniper.net/s/article/2024-07-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R1-release

CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover Severity: CRITICAL CVSSv4.0 Base Score: 9.3 Workarounds and Mitigations Ensure networks access to Expedition is restricted to authorized users, hosts, or networks. https://security.paloaltonetworks.com/CVE-2024-5910

Adobe Issues Critical Patches for Multiple Products, Warns of Code Execution Risks Adobe documents at least seven code execution bugs affecting Adobe Premiere Pro, Adobe InDesign and Adobe Bridge on Windows and macOS. Software maker Adobe on Tuesday released critical-severity patches for security defects in multiple enterprise-facing products and warned that both Windows and macOS are exposed to code execution attacks. https://www.securityweek.com/adobe-issues-critical-patches-for-multiple-products-warns-of-code-execution-risks/

Múltiples vulnerabilidades 0day en WBR-6013 de LevelOne Fecha 09/07/2024 Importancia 5 - Crítica Recursos Afectados LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. Descripción Francesco Benvenuto de Cisco Talos, ha descubierto 2 vulnerabilidades: una de severidad crítica y otra alta, que podrían permitir a un atacante ejecutar comandos arbitrarios. Solución No existe solución hasta el momento. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-0day-en-wbr-6013-de-levelone

Actualización para solucionar una vulnerabilidad en impresoras y equipos multifunción Ricoh Fecha 10/07/2024 Importancia 4 - Alta Recursos Afectados Versiones del firmware IM C3510/C3010 anteriores a System/Copy 2.00-00; Versiones del firmware IM C6010/C5510/C4510 anteriores a System/Copy 2.00-00; Versiones del firmware IM C2510/C2010 anteriores a System/Copy 2.00-00; Versiones del firmware IM C7010 anteriores a System/Copy 1.05-00; Versiones del firmware IM 460F/460FTL/370/370F anteriores a System/Copy 1.10-00; Versiones del firmware IP C8500 anteriores al sistema 1.04-00. Descripción Se ha detectado una vulnerabilidad de escritura fuera de límites del búfer de memoria en las impresoras multifunción (MFP) e impresoras Ricoh. https://www.incibe.es/empresas/avisos/actualizacion-para-solucionar-una-vulnerabilidad-en-impresoras-y-equipos

Blast-RADIUS: omisión de autenticación en protocolo RADIUS Fecha 10/07/2024 Importancia 5 - Crítica Recursos Afectados Blast-RADIUS es una vulnerabilidad de protocolo que afecta a todas las implementaciones de RADIUS que utilicen métodos de autenticación no EAP sobre UDP. CERT/CC ha publicado un aviso recogiendo información sobre esta vulnerabilidad, así como un listado con los fabricantes afectados, que puede consultarse en las referencias. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/blast-radius-omision-de-autenticacion-en-protocolo-radius