Type to search
Advanced channel search

All-in-One AI Assistant

Create any premium quality media content. Voice mode.
img
ad

TGStat Bot

Bot to get channel statistics without leaving Telegram
img
ad

SearcheeBot

Your guide in the world of telegram channels
img
ad

Vulnerability Management and more

@avleonovcom
Channel's geo and language: World, English
Category: Technologies

Vulnerability assessment, IT compliance management, security automation and other beautiful stuff. Discussion group for this channel: @avleonovchat. PM me @leonov_av

Related channels  |  Similar channels
Channel's geo and language
World, English
Category
Technologies
Statistics
Is this your channel? Confirm Канал в реестре блогеров РКН? Confirm Channel history
Posts filter

Vulnerability Management and more

27 Feb, 13:32

Open in Telegram Share Report
About Authentication Bypass - PAN-OS (CVE-2025-0108) vulnerability. PAN-OS is the operating system used in all Palo Alto Network NGFWs. This vulnerability allows an unauthenticated attacker to gain access to the PAN-OS management web interface. The attacker can then "invoke certain PHP scripts", compromising the integrity and confidentiality of PAN-OS. 😏

🔹 The vendor bulletin was released on February 12. On the same day, Assetnote posted a write-up on the vulnerability. The next day, a PoC exploit appeared on GitHub.

🔹 On February 18, GreyNoise reported that they had detected active exploitation attempts. According to Palo Alto, the vulnerability is being exploited alongside EoP CVE-2024-9474 and Authenticated File Read CVE-2025-0111 vulnerabilities. As a result, the attacker gains the ability to execute Linux commands on the device as root. 😱

Install updates and restrict access to administrative web interfaces! 😉

На русском

@avleonovcom #PANOS #PaloAlto #Assetnote #GreyNoise
235 0 1 1
Vulnerability Management and more

25 Feb, 13:19

Open in Telegram Share Report
February Linux Patch Wednesday. There are 561 vulnerabilities in total. 338 in Linux Kernel. Formally, there is one vulnerability with a sign of exploitation in the wild: RCE - 7-Zip (CVE-2025-0411). But it is about Windows MoTW and, naturally, is not exploitable on Linux.

There are public exploits for 21 vulnerabilities.

Among them there are 5 Cacti vulnerabilities:

🔸 RCE - Cacti (CVE-2025-24367)
🔸 Command Injection - Cacti (CVE-2025-22604)
🔸 SQLi - Cacti (CVE-2024-54145, CVE-2025-24368)
🔸 Path Traversal - Cacti (CVE-2024-45598)

2 OpenSSH vulnerabilities discovered by Qualys:

🔸 DoS - OpenSSH (CVE-2025-26466)
🔸 Spoofing/MiTM - OpenSSH (CVE-2025-26465)

Of the rest, the most interesting are:

🔸 RCE - Langchain (CVE-2023-39631), Snapcast (CVE-2023-36177), Checkmk (CVE-2024-13723),
🔸 EoP - Linux Kernel (CVE-2024-50066)
🔸 SQLi - PostgreSQL (CVE-2025-1094)
🔸 XSS - Checkmk (CVE-2024-13722), Thunderbird (CVE-2025-1015)

🗒 Full Vulristics report

На русском

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux
340 0 5 1 1
Vulnerability Management and more

18 Feb, 20:28

Open in Telegram Share Report
New episode "In The Trend of VM" (#11): vulnerabilities that became trending in December and the final report on trending vulnerabilities for 2024. I made this episode exclusively for the Telegram channel @avleonovcom "Vulnerability Management and More". 😉

📹 Video on YouTube, LinkedIn
🗞 Post on Habr (rus)
🗒 Digest on the PT website

Content:

🔻 00:00 Greetings
🔻 00:28 Elevation of Privilege - Windows Kernel Streaming WOW Thunk Service Driver (CVE-2024-38144)
🔻 01:30 Elevation of Privilege - Windows Common Log File System Driver (CVE-2024-49138)
🔻 02:37 Remote Code Execution - Apache Struts (CVE-2024-53677)
🔻 03:31 Authentication Bypass - Hunk Companion WordPress plugin (CVE-2024-11972)
🔻 04:44 Trending vulnerabilities for 2024

👾 08:10 Channel mascot 😅

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #Microsoft #ksthunk #Windows #SSD #CLFS #HNSecurity #CrowdStrike #Apache #Struts #WPScan #HunkCompanion #WordPress
In The Trend of VM #11: 4 December CVEs and the FINAL Review of 2024's Trending Vulnerabilities
In the new episode "In The Trend of VM" I talk about 4 vulnerabilities that became trending in December and summarize the results of 2024 for trending vulnerabilities. I made this episode exclusively for the Telegram channel avleonovcom "Vulnerability Management and More". And I invite you to subscr...
500 0 2 2
Vulnerability Management and more

13 Feb, 01:01

Open in Telegram Share Report
February Microsoft Patch Tuesday. 89 CVEs, 33 added since January. Two with signs of exploitation in the wild:

🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2025-21418)
🔻 EoP - Windows Storage (CVE-2025-21391)

There are no vulnerabilities with public exploits, but there are 7 with private ones:

🔸 RCE - Microsoft Edge (CVE-2025-21279, CVE-2025-21283)
🔸 Auth. Bypass - Azure (CVE-2025-21415)
🔸 EoP - Windows Setup Files Cleanup (CVE-2025-21419)
🔸 Spoofing - Windows NTLM (CVE-2025-21377)
🔸 Spoofing - Microsoft Edge (CVE-2025-21267, CVE-2025-21253)

Among the rest, the following can be highlighted:

🔹 RCE - Windows LDAP (CVE-2025-21376), Microsoft Excel (CVE-2025-21381, CVE-2025-21387), Microsoft SharePoint Server (CVE-2025-21400), DHCP Client Service (CVE-2025-21379)
🔹 EoP - Windows Core Messaging (CVE-2025-21184, CVE-2025-21358, CVE-2025-21414), Windows Installer (CVE-2025-21373)

🗒 Full Vulristics report

На русском

@avleonovcom #Vulristics #PatchTuesday #Microsoft #Windows
632 0 2 1 5
Vulnerability Management and more

6 Feb, 19:31

Open in Telegram Share Report
About Elevation of Privilege - Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335) vulnerability. These three vulnerabilities were disclosed as part of Microsoft's January Patch Tuesday and share the same description. They were found in a component used for communications between the host OS and container-type virtual machines, such as Windows Sandbox and Microsoft Defender Application Guard (MDAG).

If the vulnerabilities are successfully exploited, an attacker can gain System privileges. Microsoft specifically notes that this is a local privilege escalation on the host system, not any type of guest to host escape.

👾 These vulnerabilities are being actively exploited in the wild, though no public exploits are currently available.

The only difference in the vulnerability descriptions is that CVE-2025-21333 is caused by Heap-based Buffer Overflow, while CVE-2025-21334 and CVE-2025-21335 are caused by Use After Free.

На русском

@avleonovcom #Microsoft #Windows #HyperV
709 0 2 3
Vulnerability Management and more

4 Feb, 15:32

Open in Telegram Share Report
About Remote Code Execution - Microsoft Configuration Manager (CVE-2024-43468) vulnerability. This vulnerability is from the October 2024 MSPT. Microsoft Configuration Manager (ConfigMgr) is used to manage large groups of computers, providing remote control, patch management, software distribution, operating system deployment, etc.

According to Microsoft, the vulnerability allowed an unauthenticated attacker to execute commands at the server or database level by sending specially crafted requests to the Management Point.

Synacktiv experts revealed the details 100 days after the October MSPT, on January 16. MP_Location service processed client messages insecurely. This flaw enabled attackers to perform SQL injections and execute arbitrary database queries with the highest privileges, including running commands on the server via xp_cmdshell. 🤷‍♂️

Public exploits are available on GitHub. There are no reports of exploitation in the wild yet.

На русском

@avleonovcom #ConfigMgr #Microsoft
681 0 3 3
Vulnerability Management and more

28 Jan, 15:22

Open in Telegram Share Report
About Remote Code Execution - 7-Zip (CVE-2025-0411) vulnerability. 7-Zip is a popular, free, open-source archiver widely used by organizations as a standard tool for managing archives.

The vulnerability is a bypass of the Mark-of-the-Web mechanism.

🔹 If you download and run a suspicious executable file on Windows, Microsoft Defender's SmartScreen will block it from executing because it comes from an untrusted source.

🔹 However, if you download a 7z archive containing another 7z archive with malware, you can execute the file with just three double-clicks, and SmartScreen won't trigger. 🤷‍♂️ This happens because 7-Zip versions prior to 24.09, released on November 30, 2024, failed to properly apply the Mark-of-the-Web label to extracted files. An exploit example is available on GitHub.

No signs of exploitation in the wild yet, but they are likely to emerge, as this is an easy way to increase the success rate of phishing attacks. Update 7-Zip!

На русском

@avleonovcom #7zip #MoTW #SmartScreen #Windows
774 0 4 1 2
Vulnerability Management and more

27 Jan, 23:34

Open in Telegram Share Report
About Authentication Bypass - FortiOS (CVE-2024-55591) vulnerability. A critical flaw allows remote attackers to gain super-admin privileges via crafted requests to the Node.js websocket module. Affected systems include Fortinet devices running FortiOS (e.g., FortiGate NGFW) and FortiProxy.

🔹 On January 10, Arctic Wolf reported attacks on Fortinet devices that began in November 2024. Attackers create accounts with random names, modify device settings, and gain access to internal systems.

🔹 The vendor advisory was published on January 14. The vulnerability was added to the CISA KEV.

🔹 A public exploit has been available on GitHub since January 21.

🔹 As of January 26, Shadow Server reports around 45,000 vulnerable devices accessible from the Internet.

The vendor recommends updating FortiOS and FortiProxy to secure versions and restricting or disabling administrative HTTP/HTTPS interfaces.

На русском

@avleonovcom #Fortinet #FortiProxy #FortiOS #ShadowServer
610 0 1 2
Vulnerability Management and more

23 Jan, 11:14

Open in Telegram Share Report
About Remote Code Execution - Windows OLE (CVE-2025-21298) vulnerability. The vulnerability is from the January Microsoft Patch Tuesday. OLE (Object Linking and Embedding) is a technology for linking and embedding objects into other documents and objects, developed by Microsoft. A common use of this technology is embedding an Excel table in a Word document.

What is this vulnerability about? The attacker’s code executes when a specially crafted RTF document is opened or when a malicious email is opened or previewed in Microsoft Outlook. In the second case, no action is required from the victim other than clicking on the message. 🤷‍♂️ Microsoft recommends viewing messages in Outlook only in plain text.

On January 20, an exploit PoC appeared on GitHub that demonstrates Memory Corruption when opening an RTF document. Now we are waiting for an RCE exploit for Outlook. 😉

There have been no reports of attacks yet.

Fix this vulnerability ASAP!

На русском

@avleonovcom #Microsoft #OLE #Outlook
692 0 6 2
Vulnerability Management and more

20 Jan, 18:02

Open in Telegram Share Report
I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies. Last year, 74 vulnerabilities were classified as trending (to compare the scale, just over 40,000 were added to NVD in 2024).

All trending vulnerabilities are found in Western commercial products and open source projects. This year, the vulnerabilities of domestic Russian products did not reach the level of criticality required to classify them as trending.

For 55 of all trending vulnerabilities there are currently signs of exploitation in attacks, for 17 there are public exploits (but no signs of exploitation) and for the remaining 2 there is only a possibility of future exploitation.

Vulnerabilities were often added to trending ones before signs of exploitation in the wild appeared. For example, the remote code execution vulnerability in VMware vCenter (CVE-2024-38812) was added to the list of trending vulnerabilities on September 20, 3 days after the vendor's security bulletin appeared. There were no signs of exploitation in the wild or public exploit for this vulnerability. Signs of exploitation appeared only 2 months later, on November 18.

Most of the vulnerabilities in the trending list are of the following types: Remote Code or Command Execution (24) and Elevation of Privilege (21).

4 vulnerabilities in Barracuda Email Security Gateway (CVE-2023-2868), MOVEit Transfer (CVE-2023-34362), papercut (CVE-2023-27350) and SugarCRM (CVE-2023-22952) were added in early January 2024. These vulnerabilities were massively exploited in the West in 2023, and attacks using these vulnerabilities could also tangentially affect those domestic Russian organizations where these products had not yet been taken out of service. The rest of the vulnerabilities became trending in 2024.

34 trending vulnerabilities affect Microsoft products (45%).

🔹 17 of them are Elevation of Privilege vulnerabilities in the Windows kernel and standard components.

🔹 1 Remote Code Execution vulnerability in Windows Remote Desktop Licensing Service (CVE-2024-38077).

2 trending Elevation of Privilege vulnerabilities affect Linux systems: one in nftables (CVE-2024-1086), and the second in needrestart (CVE-2024-48990).

Other groups of vulnerabilities

🔻 Phishing attacks: 19 (Windows components, Outlook, Exchange, Ghostscript, Roundcube)
🔻 Network security and entry points: 13 (Palo Alto, Fortinet, Juniper, Ivanti, Check Point, Zyxel)
🔻 Virtual infrastructure and backups: 7 (VMware, Veeam, Acronis)
🔻 Software development: 6 (GitLab, TeamCity, Jenkins, PHP, Fluent Bit, Apache Struts)
🔻 Collaboration tools: 3 (Atlassian Confluence, XWiki)
🔻 CMS WordPress plugins: 3 (LiteSpeed Cache, The Events Calendar, Hunk Companion)

🗒 Full Vulristics report

🟥 Article on the official website "Vulnerable software and hardware vs. security researchers" (rus)

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #Barracuda #MOVEitTransfer #papercut #SugarCRM #Microsoft #Windows #RDLS #Linux #nftables #needrestart #Windows #Ghostscript #Outlook #Exchange #Roundcube #PaloAlto #Fortinet #Juniper #Ivanti #CheckPoint #Zyxel #VMware #Veeam #Acronis #GitLab #TeamCity #Jenkins #PHP #FluentBit #Struts #Atlassian #Confluence #XWiki #WordPress #LiteSpeedCache #TheEventsCalendar #HunkCompanion
645 0 4 3
Vulnerability Management and more

20 Jan, 18:02

Open in Telegram Share Report
507 0 1
Vulnerability Management and more

19 Jan, 04:26

Open in Telegram Share Report
January Linux Patch Wednesday. Out of 424 total vulnerabilities, 271 are in the Linux Kernel. None show signs of exploitation in the wild, but 9 have public exploits.

🔸 RCE - Apache Tomcat (CVE-2024-56337). Based on the description, the vulnerability affects "case-insensitive file systems" like Windows or MacOS. However, Debian lists it as affecting tomcat9 and tomcat10. Either this is about rare case-insensitive Linux installations or there is an error in the description. 🤷‍♂️
🔸 RCE - Chromium (CVE-2025-0291). According to the FSTEC BDU, a public exploit exists.
🔸 RCE - 7-Zip (CVE-2024-11477). What's in the public is not an exploit, but a write-up.
🔸 Memory Corruption - Theora (CVE-2024-56431). It's not clear yet how to exploit this. 🤷‍♂️
🔸 Memory Corruption - Telegram (CVE-2021-31320, CVE-2021-31319, CVE-2021-31315, CVE-2021-31318, CVE-2021-31322). Ubuntu fixed these vulnerabilities in the rlottie library package.

🗒 Full Vulristics report

На русском

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux
628 0 2 1 2
Vulnerability Management and more

16 Jan, 14:46

Open in Telegram Share Report
The Elevation of Privilege - Windows Common Log File System Driver (CVE-2024-49138) has become more critical. Just as I wrote that nothing had been heard about this vulnerability for a month since it was first published in Microsoft's December Patch Tuesday, a public exploit for it appeared on January 15th. 🙂 It was developed by Alessandro Iandoli from HN Security. The source code and video demonstrating the exploit are available on GitHub: a local attacker runs an exe file in PowerShell and, after a second, becomes "nt authority/system". The researcher tested the exploit on Windows 11 23h2. He also promises to publish a blog post with a detailed analysis of the vulnerability.

На русском

@avleonovcom #CLFS #Windows #HNSecurity
594 0 4 3
Vulnerability Management and more

15 Jan, 12:29

Open in Telegram Share Report
What has become known about the Elevation of Privilege - Windows Common Log File System Driver (CVE-2024-49138) vulnerability from the December Microsoft Patch Tuesday a month later? Almost nothing. 🙄 This is a vulnerability in a standard Windows component, available in all versions starting with Windows Server 2003 R2. Its description is typical for EoP in Windows: if successfully exploited, a local attacker can gain SYSTEM privileges. The cause of the vulnerability is Heap-based Buffer Overflow.

Microsoft has labeled the vulnerability as being exploited in the wild, but has not provided information on where the vulnerability was being exploited or how widespread the attacks were.

The vulnerability was reported by CrowdStrike's Advanced Research Team. But neither they nor other researchers have provided technical details yet. 🤷‍♂️ And there are no exploits yet either.

So install the December Microsoft security updates and let's wait for news! 😉

Update

На русском

@avleonovcom #CLFS #Windows #CrowdStrike
588 0 2 1 1
Vulnerability Management and more

15 Jan, 02:22

Open in Telegram Share Report
January Microsoft Patch Tuesday. 170 CVEs, 10 of them were added since December MSPT. 3 exploited in the wild:

🔻 EoP - Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335). No details yet.

No vulnerabilities have public exploits. 5 have private ones:

🔸 Security Feature Bypass - Microsoft Update Catalog (CVE-2024-49147), MapUrlToZone (CVE-2025-21268, CVE-2025-21189)
🔸 EoP - Windows Installer (CVE-2025-21287)
🔸 Auth. Bypass - Azure (CVE-2025-21380)

Notable among the rest:

🔹 RCE - Windows OLE (CVE-2025-21298), Windows RMCAST (CVE-2025-21307), Microsoft Office (CVE-2025-21365), Windows Remote Desktop Services (CVE-2025-21297, CVE-2025-21309), NEGOEX (CVE-2025-21295)
🔹 EoP - Windows NTLM V1 (CVE-2025-21311), Windows Search Service (CVE-2025-21292), Windows App Package Installer (CVE-2025-21275)
🔹 Spoofing - Windows Themes (CVE-2025-21308)

🗒 Full Vulristics report

На русском

@avleonovcom #Vulristics #PatchTuesday #Microsoft #Windows
581 0 2 4
Vulnerability Management and more

13 Jan, 13:04

Open in Telegram Share Report
About Elevation of Privilege - Windows Kernel Streaming WOW Thunk Service Driver (CVE-2024-38144) vulnerability. The vulnerability is from the August Microsoft Patch Tuesday. It wasn't highlighted in reviews; all we knew was that a local attacker could gain SYSTEM privileges.

Three and a half months later, on November 27, SSD Secure Disclosure released a write-up with exploit code. This vulnerability was exploited at TyphoonPWN 2024, earning the researcher a $70,000 prize.

SSD stated in their write-up that communications with Microsoft were problematic and noted that "at the time of trying this on the latest version of Windows 11, the vulnerability still worked". It's unclear if this "time of trying" was before the August MSPT or just before the write-up was released in November. If the second option, the vulnerability might still be a 0day. 🤔🤷‍♂️

No reports of this vulnerability being exploited in attacks yet.

На русском

@avleonovcom #ksthunk #Windows #SSD
493 0 3 1
Vulnerability Management and more

11 Jan, 15:41

Open in Telegram Share Report
About Authentication Bypass - Hunk Companion WordPress plugin (CVE-2024-11972) vulnerability. ThemeHunk company develops commercial themes for WordPress CMS. And the Hunk Companion plugin is designed to complement and enhance the functionality of these themes. The plugin has over 10,000 installations.

On December 10, WPScan reported a vulnerability in Hunk Companion plugin versions below 1.9.0, allowing unauthenticated attackers to install and activate plugins from the WordPressOrg repository. The exploit has been on GitHub since December 28.

This way, attackers can install plugins that contain additional vulnerabilities. 👾 In the incident analyzed by WPScan, the attackers installed the WP Query Console plugin with RCE vulnerability CVE‑2024‑50498 on the website and exploited it to install a backdoor.

If you use WordPress, try to minimize the number of plugins and update them regularly!

На русском

@avleonovcom #WPScan #HunkCompanion #WordPress
560 0 1 2
Vulnerability Management and more

9 Jan, 17:28

Open in Telegram Share Report
Aggregators of actively discussed vulnerabilities. Alexander Redchits updated his list of services that highlight TOP CVE vulnerabilities and uploaded it with descriptions to teletype (in Russian). Now there are 11 of them:

1. Intruder's Top CVE Trends & Expert Vulnerability Insights
2. Cytidel Top Trending
3. CVE Crowd
4. Feedly Trending Vulnerabilities
5. CVEShield
6. CVE Radar
7. Vulners "Discussed in social networks"
8. Vulmon Vulnerability Trends
9. SecurityVulnerability Trends
10. CVESky
11. Vulnerability-lookup

It's great that there are so many of them! 👍 But for the most part, these services are NOT about real attacks and exploitability, but about the desire of the information security community to discuss some vulnerabilities. What is being discussed may not always be important to you.

And the attention span of the information security community is like that of a goldfish: they analyze a vulnerability/incident, demonstrate their expertise and immediately forget about it. 🤷‍♂️😏

It's fascinating to look at these selections of CVE vulnerabilities, but using these lists to prioritize vulnerabilities in the VM process is a bad idea. It's better to focus on the trending vulnerability lists provided by Positive Technologies. 😉😇

На русском

@avleonovcom #CVETop #TrendVulns
595 0 4 4
Vulnerability Management and more

9 Jan, 17:28

Open in Telegram Share Report
513 0 1
Vulnerability Management and more

9 Jan, 00:47

Open in Telegram Share Report
About Remote Code Execution - Apache Struts (CVE-2024-53677) vulnerability. Apache Struts is an open source software framework for building Java web applications. It allows developers to separate the application's business logic from the user interface. Due to its scalability and flexibility, Apache Struts is often used in large enterprise projects.

A security bulletin describing the vulnerability was released on December 14. A flaw in file upload logic allows an unauthenticated attacker to perform Path Traversal, upload a malicious file, and, under certain circumstances, perform Remote Code Execution. On December 20, a public exploit for the vulnerability was released. There are reports of exploitation attempts, but no information on successful attacks yet.

The vendor recommends upgrading to version 6.4.0 or higher and migrating applications to the new secure File Upload mechanism.

На русском

@avleonovcom #Apache #Struts
590 0 1 3
20 last posts shown.