Threat Report 10/18/24
Critical Patches Issued for Microsoft Products Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which...
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all Microsoft products have the latest version(s) installed
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
|
Multiple vulnerabilities have been discovered in Mozilla Products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
References
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user.
Affected Systems:
Adobe Substance 3D Painter 10.0.1 and earlier versions
Adobe Commerce 2.4.7-p2 and earlier versions
Adobe Commerce 2.4.6-p7 and earlier versions
Adobe Commerce 2.4.5-p9 and earlier versions
Adobe Commerce 2.4.4-p10 and earlier versions
Adobe Commerce B2B 1.4.2-p2 and earlier versions
Adobe Commerce B2B 1.3.5-p7 and earlier versions
Adobe Commerce B2B 1.3.4-p9 and earlier versions
Adobe Commerce B2B 1.3.3-p10 and earlier versions
Magento Open Source 2.4.7-p2 and earlier versions
Magento Open Source 2.4.6-p7 and earlier versions
Magento Open Source 2.4.5-p9 and earlier versions
Magento Open Source 2.4.4-p10 and earlier versions
Adobe Dimension 4.0.3 and earlier versions
Adobe Animate 2023 23.0.7 and earlier versions
Adobe Animate 2024 24.0.4 and earlier versions
Lightroom 7.4.1 and earlier versions
Lightroom Classic 13.5 and earlier versions
Lightroom Classic (LTS) 12.5.1 and earlier versions
Adobe InCopy 19.4 and earlier versions
Adobe InCopy 18.5.3 and earlier versions
Adobe InDesign ID19.4 and earlier version
Adobe InDesign ID18.5.3 and earlier version
Adobe Substance 3D Stager 3.0.3 and earlier versions
Adobe FrameMaker 2020 Release Update 6 and earlier versions
Adobe FrameMaker 2022 Release Update 4 and earlier versions
Risk
Remediation Recommendations
Ensure all versions of all Adobe products are updated to their latest versions
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all devices running Android OS have the latest version(s) installed
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
https://source.android.com/docs/security/bulletin/2024-10-01
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet flaw (CVE-2024-23113) to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal agencies to patch the flaw by October 30th. Fortinet fixed the flaw in February, but many devices remain unpatched. CyberScoop notes that, as of Sunday, more than 86,000 IP addresses were vulnerable.
The flaw is a format string vulnerability affecting Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb, allowing "a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests." The vulnerability was assigned a CVSS score of 9.8.
Critical Patches Issued for Microsoft Products Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which...
Multiple Vulnerabilities in Google ChromeCould Allow for Arbitrary Code Execution Multiple vulnerabilities have been discovered in Google Chrome,...
Multiple Vulnerabilities in Google ChromeCould Allow for Arbitrary Code Execution Multiple vulnerabilities have been discovered in Google Chrome,...