Vulnerability Management

CISA has updated its Known Exploited Vulnerabilities catalog to include an old critical use-after-free flaw impacting Internet Explorer and a medium severity information disclosure bug affecting Twilio Authy.

Users of Splunk Enterprise on Windows versions earlier than 9.2.2, 9.1.5, and 9.0.10 should immediately apply fixes for this high-severity path traversal vulnerability.

Cisco said the vulnerability was caused by an improper implementation of the password change process.

CISA has updated its Known Exploited Vulnerabilities catalog to include a critical GeoServer flaw, tracked as CVE-2024-36401.

The new "Trojan Source" vulnerability enables stealthy malicious source code injections and could mean upstream attacks similar to the SolarWinds supply chain intrusion nearly four years ago.

The PHP vulnerability, tracked as CVE-2024-4577, have been launched by several threat actors shortly after the flaw's disclosure in late spring.