A coding vulnerability in Microsoft's Azure Pipelines affected 70,000 open-source projects.
With the recent surge in critical vulnerabilities, organizations should regularly update and patch software, and perform routine vulnerability assessments and penetration testing.
Keep reading for further details on this week's vulnerabilities.
Type of vulnerability: Missing authentication flaw and cross-site scripting vulnerability.
The problem: Juniper Networks' SRX and EX Series include high-severity weaknesses, particularly CVE-2024-21619, a missing authentication vulnerability that exposes sensitive information, and CVE-2024-21620, a cross-site scripting bug that allows arbitrary command execution.
The Known Exploited Vulnerabilities list also added the previously disclosed issues CVE-2023-36846 and CVE-2023-36851, emphasizing the importance of immediate fix.
Type of vulnerability: Code vulnerability in Microsoft's Azure Pipelines.
The problem: Legit Security researchers discovered a vulnerability in Azure Pipelines that affects approximately 70,000 open-source projects.
The fix: Microsoft already issued a fix in October 2023 to address this vulnerability.
Apple Faces New Active Exploitation in Multiple OS. Type of vulnerability: Kernel flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS. The problem: CVE-2022-48618 allows attackers with arbitrary read and write privileges to potentially overcome Pointer Authentication, which affects several Apple operating systems.
Despite Apple's December 2022 patch, the flaw's public disclosure a year later exposes possible vulnerabilities in devices running versions prior to iOS 15.7.1, requiring immediate action.
Given the reported vulnerability, federal civilian executive branch agencies should implement solutions by February 21, 2024.
Type of vulnerability: Heap-based buffer overflow vulnerability in the GNU C library.
The problem: A recently discovered vulnerability in glibc's vsyslog internal() function poses a serious threat to Linux systems, allowing local attackers to gain complete root access.
Jenkins CLI Vulnerability Enables RCE. Type of vulnerability: Arbitrary file read vulnerability that can allow RCE. The problem: CVE-2024-23897 reveals a significant vulnerability in the Jenkins CLI, allowing attackers to access files on the controller file system.
With a CVSS score of 9.8, the vulnerability allows remote code execution and other attacks.
The fix: Following the vulnerability patches last week, there's a newly updated Proof-of-Concept exploit for CVE-2024-23897 published on GitHub.
Type of vulnerability: Privilege escalation and server-side request forgery.
CISA published an advisory outlining updated mitigations to prevent threat actors from exploiting vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways on Ivanti devices.
Type of vulnerability: Critical origin validation error.
This Cyber News was published on www.esecurityplanet.com. Publication date: Mon, 05 Feb 2024 21:13:04 +0000