Digest · Tuesday
Security digest: November 12, 2024
5 known exploited (cisa kev) additions and 1 critical advisory.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Microsoft Windows, Metabase Metabase, Atlassian Jira Server and Data Center, Cisco Adaptive Security Appliance (ASA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-12-03.
- NuGet: 1 critical advisory (
System.Formats.Nrbf). Check withdotnet list package --vulnerable --include-transitive. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 5
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-49039 | Microsoft Windows Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | 2024-12-03 |
| CVE-2024-43451 | Microsoft Windows Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 2024-12-03 |
| CVE-2021-41277 | Metabase Metabase Metabase GeoJSON API Local File Inclusion Vulnerability | 2024-12-03 |
| CVE-2021-26086 | Atlassian Jira Server and Data Center Atlassian Jira Server and Data Center Path Traversal Vulnerability | 2024-12-03 |
| CVE-2014-2120 | Cisco Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 2024-12-03 |
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- .NET Remote Code Execution Vulnerability CVE-2024-43498 CVSS 9.2 Critical
System.Formats.Nrbf< 9.0.0 → fixed in 9.0.0