Welcome to CVE Critical!

Easily track newly reported CVE Critical vulnerabilities here. For selected vendors monitoring visit this group @CVEMonitoring

It is important that you stay up to date with the latest security threats and take the necessary measures to protect your systems and data.

This channel is running on @ChatBossNews engine

While @CVEMonitoring is up and running, @CVECritical is still under development. Track news here https://t.me/CVEMonitoring/757

GitLab Critical Security Release: 16.3.4 and 16.2.7

about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released

CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc’s ld.so

nvd.nist.gov/vuln/detail/CVE-2023-4911

blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so#potential-impact-of-looney-tunables

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

nvd.nist.gov/vuln/detail/CVE-2023-26360

Palo Alto Networks: CVE-2024-3400

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Fixes for PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 are in development and are expected to be released by April 14, 2024. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.

Tenable: CVE-2024-4323

A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.

Intel: CVE-2024-0762

Potential buffer overflow
in unsafe UEFI variable handling

in Phoenix SecureCore™ for select Intel platforms

This issue affects:

Phoenix

SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998;

Phoenix

SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562;

Phoenix

SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323;

Phoenix

SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287;

Phoenix

SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236;

Phoenix

SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184;

Phoenix

SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269;

Phoenix

SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218;

Phoenix

SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.

Microsoft Defender: CVE-2024-38089
Severity: CRITICAL
Attack Vector: NETWORK

Microsoft Defender for IoT Elevation of Privilege Vulnerability

One-Click RCE in ASUS's Preinstalled Driver Software

https://mrbruh.com/asusdriverhub/

https://youtu.be/xC8qfXxAhAw

They found another bug in sudo, and this time it's pretty bad.

https://www.youtube.com/watch?v=9nRr3R9gEb8

Pwn2Own hackers drop 4 crazy 0-day's around VMware products. Absolutely crazy.

youtu.be/AN_3ps5bl7o

@CVEMonitoring