erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: July 29, 2024

3 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Do you run any of these? ServiceNow Utah, Vancouver, and Washington DC Now Platform, Acronis Cyber Infrastructure (ACI). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-08-19.
  • Composer (PHP): 2 critical advisories (admidio/admidio). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-5217ServiceNow Utah, Vancouver, and Washington DC Now Platform
ServiceNow Incomplete List of Disallowed Inputs Vulnerability		2024-08-19
CVE-2024-4879ServiceNow Utah, Vancouver, and Washington DC Now Platform
ServiceNow Improper Input Validation Vulnerability		2024-08-19
CVE-2023-45249Acronis Cyber Infrastructure (ACI)
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability		2024-08-19

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 2

Check: composer audit