Vulnerabilities: Better to Be Smart Than Lucky

This month is all about luck – March is chock full of pots of gold, four-leaf clovers, and rainbows. While it’s great to be lucky regarding the lottery or hitting every green light when you’re late to work, one thing you don’t want to leave to the chance of luck is remediating vulnerabilities. 

We’ve seen quite a few critical vulnerabilities since 2024 began. Here are a few that caught our attention:

CVE-2024-20674

In January, we saw a severe security vulnerability in Windows Kerberos, which leverages a mechanism allowing attackers to sidestep certain security measures, potentially gaining unauthorized access to guarded information.

CVE-2024-2140

February surfaced this elevation of privilege vulnerability which could allow an unauthenticated attacker to manipulate the plugin's configuration, leading to unauthorized access.

CVE-2024-26164

In March, this CVE hit the scene. It makes it possible for attackers to carry out SQL injection attacks by exploiting an unsanitized parameter within a SQL query. The impact of such an attack includes arbitrary code execution and potential leakage of sensitive data, posing a severe threat to affected systems.

Another March concern doesn’t just include one vulnerability, but 68. And bad actors can exploit these due to the expanding MacOS user base.

It’s more than likely that you have several devices affected by one or more of the vulnerabilities above. Staying vigilant about these vulnerabilities is the only way to prevent bad actors from getting into your systems. You may be lucky if you haven’t yet patched all of these, but wouldn’t you rather sleep better at night knowing they’re taken care of? 

We’ve got you covered. Every month, we release the Patch Tuesday blog and the new Patch [FIX] Tuesday podcast to recap a few choice Patch Tuesday releases so IT folks can stay up to date on the most critical patches. 

We wish you all the luck in the world, but it’s always better to be safe than sorry. Tune into the Patch [FIX] Tuesday podcast and the CISO IT podcast for security best practices, the latest CVEs, and more so you’re so prepared you won’t need luck.