Security Advisories: Nov 25 to Dec 01, 2024

CVE-2024-11979

Title: Interinfo DreamMaker – Unrestricted File Upload through Path Traversal

Published Date: Nov 29, 2024

Risk Index: 4.96 of 10 (Medium)

Summary: A critical vulnerability has been identified in the path traversal mechanism of Interinfo’s DreamMaker. This vulnerability allows unauthenticated remote attackers to upload arbitrary files to any directory on the system, potentially leading to arbitrary code execution through the upload of webshells.

If this vulnerability is exploited, an attacker could gain unauthorized access to the server, leading to arbitrary code execution. This could allow the attacker to manipulate the system, access sensitive data, or deploy additional malicious activities, such as installing ransomware or further exploiting the network for lateral movements.

CVE-2024-11925

Title: WP JobSearch <= 2.6.7 – Authentication Bypass to Account Takeover and Privilege Escalation

Published Date: Nov 28, 2024

Risk Index: 4.67 of 10 (Medium)

Summary: A critical vulnerability has been identified in the email verification component of the WP JobSearch plugin for WordPress, which can allow unauthenticated attackers to escalate privileges and potentially take over accounts, including those of site administrators.

If exploited, this vulnerability could allow an attacker to gain unauthorized access to any user’s account, including administrative accounts, thereby taking complete control of the affected WordPress site. This could lead to unauthorized access to sensitive data, defacement of the website, and further exploitation to compromise additional systems or spread malware.

CVE-2020-17144

Title: Microsoft Exchange Remote Code Execution Vulnerability

Published Date: Dec 08, 2020

Risk Index: 9.28 of 10 (Critical)

Summary: A critical vulnerability has been identified in the XML parser component of Microsoft Exchange Server. This remote code execution vulnerability, identified as CVE-2020-17144, allows an attacker to execute arbitrary code on the affected system. The vulnerability is due to improper deserialization of untrusted data, which could be exploited by sending a specially crafted request to an affected version of Microsoft Exchange Server.

If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive data or execute arbitrary code on the affected system. The consequences of such an exploit include full system compromise, potentially leading to the exposure of confidential information, disruption of services, and installation of additional malicious software, including ransomware.

CVE-2021-34448

Title: Scripting Engine Memory Corruption Vulnerability

Published Date: Jul 13, 2021

Risk Index: 9.22 of 10 (Critical)

Summary: A critical vulnerability has been identified in the XML parser component of Microsoft Windows, designated as CVE-2021-34448. This vulnerability involves Scripting Engine Memory Corruption, posing a significant risk to systems running the affected software configurations.

If exploited, this vulnerability could allow an attacker to: – Gain unauthorized access to sensitive data – Execute arbitrary code on the affected system – Potentially take complete control over the system, depending on the user’s privileges The attacker could install programs, view, change, or delete data, and create new accounts with full user rights, leading to severe security breaches and data integrity issues.

CVE-2020-1472

Title: Netlogon Elevation of Privilege Vulnerability

Published Date: Jan 01, 2020

Risk Index: 9.97 of 10 (Critical)

Summary: A critical vulnerability has been identified in the Netlogon Remote Protocol (MS-NRPC) used by domain controllers. This vulnerability, tracked as CVE-2020-1472, allows an unauthenticated attacker to connect to a domain controller and gain domain administrator access, potentially compromising the entire domain.

If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive data or execute arbitrary code on the affected system. Specifically, an unauthenticated attacker can impersonate any machine on the network, including domain controllers, leading to a complete domain takeover. The attacker can reset the domain controller’s password, allowing them to further compromise the network and escalate privileges to domain administrator.