Vulnerability Management

Extensive account exposure by a misconfigured API was discovered by game developer and ethical hacker Sean Kahler through a developer testing environment privileged access token obtained following the identification of hardcoded credentials in a game's executable.

Malicious multi-factor authenticators could be added by threat actors to ISVA through the abuse of the solution's authentication bypass issue and back-end access, which could then allow complete infrastructure takeovers, noted Barre.

Leading the actively exploited bugs is an Android Framework privilege escalation issue, tracked as CVE-2024-43093, which could be utilized to facilitate unauthorized Android directory and sub-directory access.

Weights and Biases' open-source Weave toolkit for generative artificial intelligence development has been impacted with a directory traversal flaw, tracked as CVE-2024-7340, which could be leveraged to facilitate unauthorized file access and privilege escalation, while ML pipeline management platform ZenML Cloud was affected by an improper access control bug.

Included in the leaked files were data for Cisco clients and other DevHub users, as well as certain CX Professional Services customers, who have already been informed about the breach.

The Gemini 1.5 Pro-driven agent used variant analysis to discover the stack buffer underflow flaw.

According to the UK's FCA, third-party related issues were the leading cause of operational incidents reported between 2022 and 2023.