--- title: "Security digest: November 12, 2024" url: https://erroneo.us/security/2024-11-12/ description: "November 12, 2024 vulnerability digest: 5 CISA KEV additions (Atlassian, Cisco, Metabase, Microsoft); 1 critical advisory (NuGet). What to patch and who can…" type: security-digest-day section: "Security Digest" date_published: 2024-11-12 date_modified: 2024-11-12 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: November 12, 2024 5 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Microsoft Windows, Metabase Metabase, Atlassian Jira Server and Data Center, Cisco Adaptive Security Appliance (ASA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-12-03. - NuGet: 1 critical advisory ( System.Formats.Nrbf ). Check with dotnet list package --vulnerable --include-transitive . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-49039](https://erroneo.us/security/cve/CVE-2024-49039/index.md) Microsoft Windows: Microsoft Windows Task Scheduler Privilege Escalation Vulnerability (CISA due 2024-12-03) - [CVE-2024-43451](https://erroneo.us/security/cve/CVE-2024-43451/index.md) Microsoft Windows: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability (CISA due 2024-12-03) - [CVE-2021-41277](https://erroneo.us/security/cve/CVE-2021-41277/index.md) Metabase Metabase: Metabase GeoJSON API Local File Inclusion Vulnerability (CISA due 2024-12-03) - [CVE-2021-26086](https://erroneo.us/security/cve/CVE-2021-26086/index.md) Atlassian Jira Server and Data Center: Atlassian Jira Server and Data Center Path Traversal Vulnerability (CISA due 2024-12-03) - [CVE-2014-2120](https://erroneo.us/security/cve/CVE-2014-2120/index.md) Cisco Adaptive Security Appliance (ASA): Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability (CISA due 2024-12-03) ## Critical advisories - [CVE-2024-43498](https://erroneo.us/security/cve/CVE-2024-43498/index.md) .NET Remote Code Execution Vulnerability — NuGet System.Formats.Nrbf < 9.0.0 → 9.0.0 --- Source page: https://erroneo.us/security/2024-11-12/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt