Rapid CVE Mitigation by Cato Security Research

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

A Remote Code Execution vulnerability in Atlassian Confluence Server & Data Center, allowing unauthenticated attackers to gain RCE access through template injection.

Remote code execution via flawed file upload logic in Apache Struts 2 web framework, allowing for arbitrary file upload and code execution

Privilege escalation is possible in internet facing Cisco devices running IOS XE and have the HTTP Web UI feature running

A Heap Buffer Overflow vulnerability in hostname resolution during a SOCKS5 proxy handshake can result in malicious code execution by a vulnerable libcurl implementation

A Privilege Escalation Vulnerability in the on-premises version of Atlassian Confluence Server & Data Center, allowing attackers to exploit a vulnerable endpoint to create unauthorized administrator users and gain server access

An SQLi in the managed file transfer (MFT) solution MOVEit Transfer by InProgress allows attackers to execute SQL commands and can result in installation of a dedicated backdoor allowing for RCE.

Microsoft Outlook Elevation of Privilege Vulnerability * On the zero time: Outbound SMB traffic is blocked by default on Cato’s firewall

Part of the ProxyNotShell exploit chain, some versions of MS Exchange are vulnerable to RCE (Remote Code Execution)

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file

Windows Print Spooler Elevation of Privilege Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server

On specific versions of BIG-IP and BIG-IQ , the iControl REST interface has an unauthenticated remote command execution vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.