---
title: "Security digest: November 18, 2024"
url: https://erroneo.us/security/2024-11-18/
description: "November 18, 2024 vulnerability digest: 1 brief (Operation Lunar Peek); 3 CISA KEV additions (Palo Alto Networks, Progress); 2 critical advisories (Maven…"
type: security-digest-day
section: "Security Digest"
date_published: 2024-11-18
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 18, 2024

1 editorial brief, 3 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Check exposure: Operation Lunar Peek . Anyone running PAN-OS 10.2-11.2 (or 10.1 for CVE-2024-9474) whose management web interface was reachable from the internet or untrusted networks, including via a management profile on a dataplane or GlobalProtect interface.
- Do you run any of these? Palo Alto Networks PAN-OS, Progress Kemp LoadMaster. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-12-09.
- Maven: 1 critical advisory ( org.apache.tomcat:tomcat-catalina ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( cobbler ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [PAN-OS Management Auth Bypass Chain (Lunar Peek)](https://erroneo.us/security/briefs/pan-os-cve-2024-0012-9474-lunar-peek/index.md): Exploited at scale in late 2024 and patched for almost two years; if your management interface was ever internet-reachable, verify the fix and hunt for leftovers rather than assume you are clean.

## Known exploited (CISA KEV)

- [CVE-2024-9474](https://erroneo.us/security/cve/CVE-2024-9474/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability (CISA due 2024-12-09)
- [CVE-2024-1212](https://erroneo.us/security/cve/CVE-2024-1212/index.md) Progress Kemp LoadMaster: Progress Kemp LoadMaster OS Command Injection Vulnerability (CISA due 2024-12-09)
- [CVE-2024-0012](https://erroneo.us/security/cve/CVE-2024-0012/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability (CISA due 2024-12-09)

## Critical advisories

- [CVE-2024-52316](https://erroneo.us/security/cve/CVE-2024-52316/index.md) Apache Tomcat - Authentication Bypass — Maven org.apache.tomcat:tomcat-catalina < 9.0.96 → 9.0.96; Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.30 → 10.1.30; Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, <= 11.0.0-M26 → 11.0.1
- [CVE-2024-47533](https://erroneo.us/security/cve/CVE-2024-47533/index.md) cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes — PyPI cobbler >= 3.3.0, < 3.3.7 → 3.3.7; PyPI cobbler >= 3.0.0, < 3.2.3 → 3.2.3

---
Source page: https://erroneo.us/security/2024-11-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt