Weekly Vulnerability Summary: 7 New Vulnerabilities for the week of November 12, 2023
In our latest weekly update of cybersecurity vulnerabilities, a number of security products, operating systems, and other core components are mentioned. This goes to show that not even us cybersecurity companies are immune to vulnerabilities, exploits, and attacks. Hackers are crafty and will use any foothold they can get.
Tenable Nessus Agent Vulnerability
Tenable Nessus agents were subject to a code injection vulnerability. The script code could be injected to a document’s operation (in this case “drawing”) that could be executed for users that are actively collaborating on the same document. CVE-2023-29045 was described in Tenable’s announcement, which luckily shows that execution is difficult, access after is limited, and there are no known exploits.
Microsoft .NET Core Multiple Vulnerabilities
It will come as no surprise that .NET has a new set of vulnerabilities and patches. Microsoft’s products are used worldwide in many applications and companies, in a large variety of ways, making them the perfect target. This includes a security bypass vulnerability that can be used by an unauthenticated attacker. CVE-2023-36558 is part of a large group of .NET patches that should be implemented to ensure your users are secure.
VMware Cloud Director Authentication Bypass
VMWare announced another critical vulnerability: VMSA-2023-0026. A hacker with network access to the appliance can bypass login restrictions when authenticating on port 22 (SSH) or port 5480 (VMWare management console) but not port 443 (HTTPS). Interestingly enough, only deployments that have upgraded to 10.5 from an older release are impacted, which suggests a lack of testing of the software in conditions that were upgrades instead of fresh installs. Security testing is difficult for any software that can be used, upgraded, or installed in a variety of methods. This is an example for the companies that have a wide variety of users and use-cases to double check how their customers are using your software and amke sure they are safe.
Splunk Enterprise XSS
Splunk announced a vulnerability in their web interface, SVD-2023-1103, that would allow an attacker to execute code. The vulnerability, CVE-2023-46213, allows an attacker to craft a log file which can execute unauthorized Javascript code in the user’s browser interacting with events from that file because the “Show syntax highlighted” feature of the “Search” page does not effectively escape log file characters. This is a fairly contrived vulnerability, but shows how varied these attacks can be if a hacker gets access to any system. It also highlights the risk of a advanced persistent threat to slowly make their way through an organization to get what they need.
Amazon Linux 2 Numerous Vulnerabilities
Amazon Linux released a large amount of patches tied to numerous vulnerabilities that could impact any company that uses it. While many of these had been found in Amazon Linux 1, they were not discovered in Amazon Linux 2 until recently.
