The Precursor Security Weekly Vulnerability Roundup for week commencing 21st October 2024
.png)
Get Your 'Vulnerability Management Template' FREE!
Your Vulnerability Management Template Includes:
Secure your organisation today by completing the form for your Vulnerability Management Template.
Download the, 'How to secure Microsoft Office Desktop Deployments Technical Guide' - FREE
Complete the form to download your free technical guide and secure your organisation today.
Download the Cyber Essentials Template Policy Pack - FREE
Complete the form to download your FREE Cyber Essentials Template Pack today, including:
Download the Microsoft 365 Security Guide - FREE
Complete the form to download your FREE Microsoft 365 Security Guide today, including:
Sign up on the form and receive the guide instantly.
This week, we've identified alarming EPSS score increases among vulnerabilities that target widely-used Microsoft products, including SharePoint, Internet Explorer, and the Office suite. The trend is disturbing, with exploit probability surging massively. Among these, new entries from Microsoft SharePoint and ScienceLogic SL1 were added to the CISA KEV list, making a total of 2 new KEV-listed vulnerabilities, which are critical to be addressed. Importantly, these new KEV list additions now face higher risks of being exploited and therefore immediate action must be taken to apply available patches and reinforce defensive measures to avoid being vulnerable. This pattern of vulnerabilities reveals a pressing need for continuous monitoring and swift response to emerging threats, especially within Microsoft environments.
EPSS Increase Delta: 96.71%
Original Score: 0.05%
Affected Technology: Veeam Backup & Replication
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2024-40711 jumped dramatically from 0.05% to 96.76%, indicating a significant increase in the likelihood of exploitation. This vulnerability involves deserialization of untrusted data, which could permit unauthenticated remote code execution. Immediate attention and patching are advised to mitigate this high-risk issue.
EPSS Increase Delta: 55.71%
Original Score: 18.14%
Affected Technology: Palo Alto Networks Expedition
Is New CISA Known Exploited Vulnerability: False
EPSS delta shows a significant increase from 18.14% to 73.85%, indicating a heightened risk associated with this vulnerability. CVE-2024-9465 is an SQL injection vulnerability in Palo Alto Networks Expedition that poses a severe threat by allowing an unauthenticated attacker to disclose critical Expedition database contents, including password hashes, usernames, device configurations, and device API keys. Such access also enables the attacker to create and read arbitrary files on the Expedition system. Immediate attention is required to mitigate this issue.
EPSS Increase Delta: 47.17%
Original Score: 1.07%
Affected Technology: Microsoft Windows Media Foundation
Is New CISA Known Exploited Vulnerability: False
The EPSS has increased significantly from 1.07% to 48.24%, representing a delta of 47.17%. This indicates a greater risk of this vulnerability being weaponized in the wild. The vulnerability in question is a Remote Code Execution flaw in Microsoft Windows Media Foundation. Successful exploitation could allow an attacker to execute arbitrary code on the affected system. Users are urged to apply security updates provided by Microsoft to mitigate the risk associated with this vulnerability.
EPSS Increase Delta: 47.17%
Original Score: 1.07%
Affected Technology: Visual Studio
Is New CISA Known Exploited Vulnerability: False
The analysis reveals a significant increase in the estimated probability of exploitation, with the EPSS percentage surging by 47.17% to 48.24%. This vulnerability pertains to a Remote Code Execution flaw within Visual Studio. Observations suggest that the threat posed by this vulnerability to the affected systems is alarming due to the potential for a remote attacker to execute arbitrary code. Users are advised to apply updates provided by software vendors diligently to mitigate the risks associated with this vulnerability.
EPSS Increase Delta: 44.39%
Original Score: 1.62%
Affected Technology: Drupal Core
Is New CISA Known Exploited Vulnerability: False
EPSS increased from 1.62% to 46.01%, indicating a significant rise in risk. Drupal Core has a vulnerability where uploaded files are not adequately sanitized. This can result in incorrect file execution or MIME type interpretation, especially for specific hosting configurations. Drupal versions affected include 9.0 (before 9.0.8), 8.9 (before 8.9.9), 8.8 (before 8.8.11), and 7 (before 7.74). Update to the latest Drupal version to remediate.
EPSS Increase Delta: 39.59%
Original Score: 2.77%
Affected Technology: Windows Fax Service
Is New CISA Known Exploited Vulnerability: False
The EPSS has increased significantly by 39.59% from the original 2.77% to the new 42.36%. This vulnerability pertains to a Windows Fax Service Remote Code Execution Vulnerability. No remediation actions are provided in the current vulnerability information.
EPSS Increase Delta: 39.59%
Original Score: 2.77%
Affected Technology: Microsoft Excel
Is New CISA Known Exploited Vulnerability: False
The EPSS score increased from 2.77% to 42.36%, a change of 39.59%, indicating a significant rise in potential exploitability for vulnerability CVE-2022-29110. This vulnerability pertains to a remote code execution issue within Microsoft Excel. Currently, no remediation actions are specified from the vulnerability information available.
EPSS Increase Delta: 39.59%
Original Score: 2.77%
Affected Technology: Windows Address Book
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2022-26926 has seen a substantial increase, with a 39.59% delta, signaling an escalated risk. This vulnerability pertains to a remote code execution flaw in the Windows Address Book, which could allow an attacker to execute arbitrary code. Given the rise in risk, it is imperative to prioritize patch management and apply updates provided by the software vendor.
EPSS Increase Delta: 39.59%
Original Score: 2.77%
Affected Technology: Microsoft Excel
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2022-29109 has risen significantly by approximately 39.59%, indicating an increased risk associated with this vulnerability. A Remote Code Execution flaw has been identified in Microsoft Excel, which could allow an attacker to execute code remotely if they can persuade a user to open a specially crafted file. It is crucial to apply security updates provided by Microsoft to mitigate this risk.
EPSS Increase Delta: 36.87%
Original Score: 23.88%
Affected Technology: Microsoft Office Access
Is New CISA Known Exploited Vulnerability: False
EPSS has increased significantly from 23.88% to 60.75%, indicating a heightened risk associated with this vulnerability. The core issue is a Remote Code Execution flaw within Microsoft Office Access Connectivity Engine, which means an attacker could execute arbitrary code on a compromised system. Users are encouraged to apply updates provided by Microsoft to mitigate this risk.
EPSS Increase Delta: 32.01%
Original Score: 23.15%
Affected Technology: Windows Graphics Component
Is New CISA Known Exploited Vulnerability: False
EPSS has increased from 23.15% to 55.16%, a delta of 32.01%. The vulnerability concerns a remote code execution flaw in the Windows Graphics Component, which could allow an attacker to execute arbitrary code if exploited. There is currently no CISA KEV alert associated with this vulnerability.
EPSS Increase Delta: 29.91%
Original Score: 4.32%
Affected Technology: Apache Batik
Is New CISA Known Exploited Vulnerability: False
EPSS has increased significantly from 4.32% to 34.22%, a change of 29.91%. An XML external entity (XXE) vulnerability exists in Apache Batik's conversion classes for SVG files, potentially allowing file disclosure or denial of service when processing maliciously crafted SVG content. Users should update to Apache Batik version 1.8 or later to mitigate this issue.
EPSS Increase Delta: 26.14%
Original Score: 5.92%
Affected Technology: Microsoft browsers
Is New CISA Known Exploited Vulnerability: False
EPSS indicates a significant increase with a 26.14% delta from an initial estimate of 5.92% to a current estimate of 32.06%. This reflects a higher probability of the vulnerability being exploited. The vulnerability exists in Microsoft browsers due to improper handling of objects in memory, potentially leading to remote code execution. If exploited, an attacker could gain rights equivalent to the current user, and if the user has administrative rights, the attacker could seize full control of the system. The risk is amplified if users with administrative rights are targeted. Remediation includes applying the security update from Microsoft, which modifies how the browsers handle memory objects.
EPSS Increase Delta: 22.67%
Original Score: 30.78%
Affected Technology: Jira
Is New CISA Known Exploited Vulnerability: False
EPSS increased from 30.78% to 53.45%, indicating a higher-than-average risk of exploitation. This vulnerability in Jira versions before 8.4.0 allows remote attackers to enumerate usernames through an information disclosure issue in /rest/api/latest/groupuserpicker resource. Upgrade to Jira version 8.4.0 or later to mitigate this vulnerability.
EPSS Increase Delta: 21.14%
Original Score: 6.52%
Affected Technology: HEVC Video Extensions
Is New CISA Known Exploited Vulnerability: False
CVE-2021-38661 has seen an EPSS increase from 6.52% to 27.66%, a change of 21.14%. This vulnerability relates to a remote code execution in HEVC Video Extensions. Attackers exploiting this can gain control over an affected system. While there are no specific remediation actions mentioned, standard practices include applying available patches and monitoring systems for unusual activity.
EPSS Increase Delta: 21.14%
Original Score: 6.52%
Affected Technology: Microsoft Office
Is New CISA Known Exploited Vulnerability: False
This vulnerability pertains to a significant flaw in Microsoft Office, allowing for remote code execution through the manipulation of Office graphics. This issue is critical because it permits attackers to execute arbitrary code on the victim's system, potentially leading to full system compromise if the user is logged on with administrative user rights. Immediate measures are suggested, such as applying updates provided by Microsoft. Comparing the initial EPSS score of 6.52% and the new EPSS score of 27.66%, we observe a concerning delta increase of 21.14%.
EPSS Increase Delta: 21.14%
Original Score: 6.52%
Affected Technology: Microsoft MPEG-2 Video Extension
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2021-38644 elevated from 6.52% to 27.66%, a significant increase of 21.14%. This vulnerability pertains to the Microsoft MPEG-2 Video Extension, wherein a remote code execution flaw allows attackers to compromise affected systems. No specific remediation actions are provided at this time.
EPSS Increase Delta: 20.14%
Original Score: 35.73%
Affected Technology: Microsoft Office
Is New CISA Known Exploited Vulnerability: False
EPSS has increased by 20.14% from an original 35.73% to a new likelihood of 55.87%. This vulnerability affects Microsoft Word across different versions where a crafted document can potentially allow remote attackers to execute arbitrary code. The issue is known as the Microsoft Office Memory Corruption Vulnerability. There are no specific remediation actions mentioned within this CVE entry, and this finding has not been added to the CISA KEV list.
EPSS Increase Delta: 20.14%
Original Score: 35.73%
Affected Technology: Microsoft Office
Is New CISA Known Exploited Vulnerability: False
EPSS risk score increased significantly from 35.73% to 55.87%, indicating a higher probability of exploitation. Microsoft Word across various versions is vulnerable to remote code execution due to a memory corruption issue when opening crafted documents, posing a risk of compromised systems. Users should apply available patches from Microsoft to mitigate this vulnerability.
EPSS Increase Delta: 17.78%
Original Score: 73.56%
Affected Technology: Palo Alto Networks Expedition
Is New CISA Known Exploited Vulnerability: False
EPSS score increased by 17.78% from 73.56% to 91.34%, indicating a rising risk. An OS command injection flaw in Palo Alto Networks Expedition permits unauthenticated execution of commands as root, potentially exposing sensitive firewall information. Immediate update and patching are advised.
EPSS Increase Delta: 17.29%
Original Score: 17.63%
Affected Technology: Microsoft Dynamics AX 2012
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2012-1857 has increased significantly, revealing a heightened risk. This vulnerability in the Enterprise Portal component of Microsoft Dynamics AX 2012 may allow remote attackers to perform cross-site scripting (XSS) attacks by using a specially crafted URL, known as Dynamics AX Enterprise Portal XSS Vulnerability. As a preventive measure, ensuring that all patches provided by Microsoft for Dynamics AX 2012 are applied will mitigate this risk.
EPSS Increase Delta: 15.07%
Original Score: 24.64%
Affected Technology: Sun Java Runtime Environment
Is New CISA Known Exploited Vulnerability: False
EPSS score increased from 24.64% to 39.71%, marking a delta of 15.07%. This vulnerability affects Sun Java Runtime Environment in various JDK and JRE versions where applet caching is enabled, allowing remote attackers to execute DNS rebinding attacks, potentially leading to unauthorized outbound connections. It's recommended to update to a version of JRE that is not susceptible to this issue.
EPSS Increase Delta: 13.15%
Original Score: 1.43%
Affected Technology: Total.js Platform
Is New CISA Known Exploited Vulnerability: False
EPSS has increased significantly from an initial 1.43% to a current 14.58%, marking an EPSS delta of 13.15%. The vulnerability in the Total.js Platform versions before 3.2.3 arises from a path traversal issue allowing an attacker to access files outside the server directory. Upgrade to version 3.2.3 to mitigate this risk.
EPSS Increase Delta: 11.77%
Original Score: 34.99%
Affected Technology: Linux kernel AppleTalk
Is New CISA Known Exploited Vulnerability: False
The EPSS has seen an increase from 34.99% to 46.76%, marking a notable rise of 11.77%. This vulnerability pertains to the function atalk_sum_skb in the AppleTalk protocol implementation for Linux kernels prior to 2.6.21 and some 2.4.x versions. It exposes systems to a denial of service due to an incompletely specified AppleTalk frame, resulting in a kernel crash. The corrective measure involves updating the Linux kernel to a version beyond 2.6.21 that addresses this flaw.
EPSS Increase Delta: 10.77%
Original Score: 41.31%
Affected Technology: EVlink Charging Stations
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2021-22707 saw an increase from 41.31% to 52.08%, signaling a considerable rise of 10.77% in the estimated probability of exploitation in the wild. The vulnerability concerns the use of hard-coded credentials in various EVlink charging products. This issue could grant an attacker administrative control over the charging station web servers if exploited. Users should update to the latest firmware version, following the manufacturer's guidelines, to mitigate the risk.
EPSS Increase Delta: 10.36%
Original Score: 25.54%
Affected Technology: MediaWiki
Is New CISA Known Exploited Vulnerability: False
EPSS increased from 25.54% to 35.90%, which indicates a 10.36% rise in exploitability risk. The vulnerability in question is a cross-site scripting (XSS) issue found in api.php of various MediaWiki versions and in the BotQuery extension for earlier versions, specifically affecting Internet Explorer users by allowing the injection of arbitrary web script or HTML. As MediaWiki is a widely used wiki platform, immediate steps should be taken to update to versions that resolve this issue to mitigate the risk.
EPSS Increase Delta: 10.11%
Original Score: 27.79%
Affected Technology: Microsoft Internet Explorer
Is New CISA Known Exploited Vulnerability: False
The EPSS has increased by 10.11% from an original 27.79% to a new estimate of 37.89%. This vulnerability impacts Microsoft Internet Explorer versions 8 through 11, where remote attackers can execute arbitrary code or cause a denial of service through memory corruption by exploiting a crafted website. It is a distinct issue from CVE-2015-6069, and as of the latest updates, specific remediation actions are not provided.
EPSS Increase Delta: 10.11%
Original Score: 27.79%
Affected Technology: Microsoft Internet Explorer 11
Is New CISA Known Exploited Vulnerability: False
The EPSS has increased to 37.89% from an original 27.79%, showing a delta of 10.11%. This vulnerability in Microsoft Internet Explorer 11 allows an attacker to run arbitrary code or cause a denial of service due to memory corruption by luring a victim to a malicious website. It is distinct from several other similarly noted vulnerabilities. Since exploitation involves deceiving users into visiting compromised websites, recommended mitigations include updating web browsers, training users to avoid untrusted sites, and deploying anti-malware solutions.
EPSS Increase Delta: 10.11%
Original Score: 27.79%
Affected Technology: Microsoft Internet Explorer
Is New CISA Known Exploited Vulnerability: False
EPSS increase of 10.11%, from 27.79% to 37.89%. Microsoft Internet Explorer versions 7 through 11 are vulnerable to code execution or denial of service due to memory corruption when a user visits a crafted website. This is separate from vulnerabilities CVE-2015-6066, CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, and CVE-2015-6087. Users should apply updates provided by Microsoft to mitigate this risk.
EPSS Increase Delta: 10.11%
Original Score: 27.79%
Affected Technology: Microsoft Internet Explorer 11
Is New CISA Known Exploited Vulnerability: False
The EPSS score for CVE-2015-6075 has increased by 10.11%, indicating a heightened risk. This vulnerability in Microsoft Internet Explorer 11 could allow attackers to remotely execute code or cause denial of service through memory corruption by enticing a user to visit a malicious website. Users are advised to update or switch browsers to mitigate this issue.
EPSS Increase Delta: 10.11%
Original Score: 27.79%
Affected Technology: Microsoft Internet Explorer
Is New CISA Known Exploited Vulnerability: False
EPSS shows an increase of 10.11% from an initial 27.79%, indicating a heightened risk. Microsoft Internet Explorer versions 9 to 11 have a memory corruption vulnerability allowing remote code execution or denial of service from a malicious website. Users should update their browsers or employ alternative mitigations to protect from potential exploitation.
EPSS Increase Delta: 3.40%
Original Score: 0.09%
Affected Technology: Microsoft SharePoint
Is New CISA Known Exploited Vulnerability: True
This vulnerability has been added to the CISA KEV list, indicating a growing risk associated with this threat. Microsoft SharePoint is affected by a deserialization vulnerability which could permit remote code execution if exploited. To address this, it is essential to apply mitigations as recommended by the vendor or refrain from using the affected product if no mitigations are confirmed to be available.
EPSS Increase Delta: 3.64%
Original Score: 0%
Affected Technology: ScienceLogic SL1
Is New CISA Known Exploited Vulnerability: True
EPSS has increased to 3.64%. ScienceLogic SL1, previously known as EM7, is compromised due to an undisclosed vulnerability in a third-party component. Users are advised to implement mitigations following the vendor's guidelines or cease using the affected product if no mitigations are provided.
Choose Precursor Security for penetration testing excellence—where industry-leading expertise, CREST accreditation, and a client-focused approach converge to fortify your digital defences with precision and reliability.
We have a CREST accredited Security Operations Centre and all of our penetration testers are CREST certified.
We are accredited to the highest of standards including CREST, ISO27001, ISO9001 and Cyber Essentials Plus.
![Experienced people icon]](https://cdn.prod.website-files.com/6569bb4bd6018f8bee273541/65c0fddfb82858785bf456d7_rating.png)
Our experts have a combined experience of over 30 years delivering security operations to sectors such as healthcare, financial services, aerospace and more.
It’s important to know what you’re getting, what’s not included and what else is available. This starts with understanding a SOC and it’s critical functions. CREST has recently published a guide to the critical functions of a SOC which aligns with the CREST SOC standard.
Enter your details here and to get the complete guide instantly sent to your inbox.
Choose Precursor Security for penetration testing excellence—where industry-leading expertise, CREST accreditation, and a client-focused approach converge to fortify your digital defences with precision and reliability.
We have a CREST accredited Security Operations Centre and all of our penetration testers are CREST certified.
We are accredited to the highest of standards including CREST, ISO27001, ISO9001 and Cyber Essentials Plus.
Our experts have a combined experience of over 30 years delivering security operations to sectors such as healthcare, financial services, aerospace and more.
Precursor Security
Welcome to Precursor Security, where the forefront of cybersecurity and penetration testing expertise meets unmatched dedication and innovation. We are the architects of robust digital defences, committed to safeguarding the online realm.
Sign up for the Precursor newsletter to receive valuable insights and strategies for safeguarding your organisation.
