Known Exploited Vulnerability
9.6
CRITICAL
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability - [Actively Exploited]
Description

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

Aug. 21, 2024, 9:15 p.m.

Last Modified :

Jan. 3, 2025, 7:39 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

2.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://nvd.nist.gov/vuln/detail/CVE-2024-7971

Public PoC/Exploit Available at Github

CVE-2024-7971 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-7971 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Microsoft edge
2 Microsoft edge_chromium
1 Google chrome
: Total Affected Vendor : 2 | Products : 3
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-7971.

URL Resource
https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html Release Notes
https://issues.chromium.org/issues/360700873 Permissions Required
https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/ Exploit Patch Third Party Advisory Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
mistymntncop/CVE-2024-7971

None

JavaScript WebAssembly

Updated: 1 month, 1 week ago
33 stars 5 fork 5 watcher
Born at : April 12, 2025, 11:40 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 4 weeks, 2 days ago
0 stars 0 fork 0 watcher
Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.
Profile Photo
tayvano/lazarus-bluenoroff-research

a collection of north korean apt articles, analysis and heists attributed to lazarus / bluenoroff / apt38.

Updated: 3 days, 10 hours ago
176 stars 13 fork 13 watcher
Born at : April 19, 2022, 5:18 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 13 hours ago
7146 stars 1194 fork 1194 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 815 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-7971 vulnerability anywhere in the article.

  • Help Net Security
Google patches actively exploited Chrome (CVE‑2025‑6554)

Google has released a security update for Chrome to address a zero‑day vulnerability (CVE-2025-6554) that its Threat Analysis Group (TAG) discovered and reported last week. “Google is aware that an ex ... Read more

Published Date: Jul 01, 2025 (1 month ago)
CVE-2025-6554 CVE-2025-5777 CVE-2024-7971
  • europa.eu
Cyber Brief 24-10 - September 2024

Cyber Brief (September 2024)October 1, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 269 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, in Europe, l ... Read more

Published Date: Oct 01, 2024 (10 months ago)
CVE-2024-0132 CVE-2024-45410 CVE-2024-38812 CVE-2024-7387 CVE-2024-45496 CVE-2024-40711 CVE-2024-7971 CVE-2024-36401
  • Cybersecurity News
CVE-2024-43917 (CVSS 9.3): Unpatched SQLi Flaw in TI WooCommerce Wishlist Threatens 100,000+ Sites

A critical security vulnerability has been discovered in the widely-used WordPress plugin, TI WooCommerce Wishlist, potentially exposing over 100,000 websites to malicious attacks. The flaw, tracked a ... Read more

Published Date: Sep 28, 2024 (10 months ago)
CVE-2024-47177 CVE-2024-47176 CVE-2024-47175 CVE-2024-47076 CVE-2024-45823 CVE-2024-45824 CVE-2024-43917 CVE-2024-40766 CVE-2024-7971
  • Cybersecurity News
Proxmox Virtual Environment and Mail Gateway Exposed to Critical API Vulnerability

A critical vulnerability has been identified in Proxmox Virtual Environment (VE) and Proxmox Mail Gateway (PMG) that could allow unauthorized access to sensitive files and potentially lead to a full s ... Read more

Published Date: Sep 26, 2024 (10 months, 1 week ago)
CVE-2024-21545 CVE-2024-45823 CVE-2024-45824 CVE-2024-40766 CVE-2024-39717 CVE-2024-7971 CVE-2023-24329 CVE-2022-0540
  • Cybersecurity News
Severe Unauthenticated RCE Flaw (CVSS 9.9) in GNU/Linux Systems Awaiting Full Disclosure

A critical security vulnerability affecting all GNU/Linux systems—and potentially others—has been identified by renowned security researcher Simone Margaritelli. The vulnerability, which allows for un ... Read more

Published Date: Sep 24, 2024 (10 months, 1 week ago)
CVE-2024-28991 CVE-2024-28990 CVE-2024-43102 CVE-2024-40766 CVE-2024-7971 CVE-2024-7965 CVE-2024-38063 CVE-2024-7589
  • Cybersecurity News
CVE-2024-8956 (CVSS 9.1): PTZOptics Cameras Vulnerable to Remote Attacks

A recently disclosed security flaw, CVE-2024-8956, poses a significant risk to users of certain PTZ cameras, including popular models from PTZOptics. This vulnerability, rated CVSS 9.1, opens the door ... Read more

Published Date: Sep 24, 2024 (10 months, 1 week ago)
CVE-2024-8956 CVE-2024-28991 CVE-2024-28990 CVE-2024-40766 CVE-2024-7971 CVE-2024-7965
  • Cybersecurity News
GreyNoise Intelligence Uncovers New Internet Noise Storm with Potential China Link and Cryptic “LOVE” Message

GreyNoise Intelligence has recently released findings regarding a new and increasingly complex wave of “Noise Storms” – massive, enigmatic surges of fake traffic that have baffled experts since 2020. ... Read more

Published Date: Sep 23, 2024 (10 months, 1 week ago)
CVE-2024-45695 CVE-2024-45694 CVE-2024-6342 CVE-2024-7971 CVE-2024-7965 CVE-2024-3080 CVE-2024-28995
  • Cybersecurity News
Passive Backdoors, Active Threat: UNC1860’s Espionage Tools Exposed

Mandiant has uncovered alarming evidence of a sophisticated Iranian state-sponsored cyber campaign orchestrated by UNC1860, a threat actor likely affiliated with Iran’s Ministry of Intelligence and Se ... Read more

Published Date: Sep 23, 2024 (10 months, 1 week ago)
CVE-2024-45823 CVE-2024-45824 CVE-2024-40766 CVE-2024-7971 CVE-2024-43399 CVE-2024-1148 CVE-2024-1147
  • Cybersecurity News
ZeroLogon to NoPac Vulnerability: Black Basta Group’s Exploit Arsenal Revealed

Desktop background on victim’s system after encryption | Image: QualysQualys has released a comprehensive report shedding light on the Black Basta ransomware, a highly disruptive threat that has wreak ... Read more

Published Date: Sep 22, 2024 (10 months, 1 week ago)
CVE-2024-45823 CVE-2024-45824 CVE-2024-40766 CVE-2024-7971 CVE-2024-43399 CVE-2021-42287 CVE-2021-34527 CVE-2020-1472
  • Cybersecurity News
Acronis Backup Plugins Hit by CVE-2024-8767: CVSS 9.9 Severity Alert

In a recent advisory published on September 16th, data protection powerhouse Acronis disclosed a critical security vulnerability in its popular backup plugins for server management platforms like cPan ... Read more

Published Date: Sep 20, 2024 (10 months, 2 weeks ago)
CVE-2024-7788 CVE-2024-8767 CVE-2024-8687 CVE-2024-8686 CVE-2024-7971 CVE-2023-45249 CVE-2024-20017 CVE-2023-29489
  • Cybersecurity News
PoC Exploit Released for CVE-2024-7965 Zero-Day Chrome Vulnerability

Technical specifics and a proof-of-concept (PoC) exploit have been made available for a recently uncovered zero-day vulnerability, CVE-2024-7965, in the V8 JavaScript engine. Analyzed by experts at BI ... Read more

Published Date: Sep 19, 2024 (10 months, 2 weeks ago)
CVE-2024-41992 CVE-2024-43425 CVE-2024-8529 CVE-2024-8522 CVE-2024-44082 CVE-2024-7971 CVE-2024-7965 CVE-2024-7964
  • Cybersecurity News
PoC Exploit Released for Windows Hyper-V Zero-Day Vulnerability CVE-2024-38080

Security researcher Pwndorei published a detailed analysis alongside a proof-of-concept (PoC) exploit code for a patched zero-day vulnerability in Windows Hyper-V, tracked as CVE-2024-38080. This crit ... Read more

Published Date: Sep 17, 2024 (10 months, 2 weeks ago)
CVE-2024-8687 CVE-2024-8686 CVE-2024-7971 CVE-2024-6500 CVE-2024-38080 CVE-2024-37085 CVE-2024-20017
  • Cybersecurity News
BadIIS Malware : 35+ IIS Servers Compromised in DragonRank Campaign

A recent report from Cisco Talos has exposed a new threat actor named DragonRank, a Chinese-speaking group specializing in SEO manipulation and cyberattacks. This group operates by exploiting vulnerab ... Read more

Published Date: Sep 15, 2024 (10 months, 2 weeks ago)
CVE-2024-6342 CVE-2024-7971 CVE-2024-7965 CVE-2024-28000 CVE-2024-38202 CVE-2024-21302 CVE-2024-3080 CVE-2017-7269
  • Cybersecurity News
Cisco Issues Security Advisories: Critical Vulnerabilities Impact Multiple Products

Cisco Systems has released a series of urgent security advisories, revealing a total of nine vulnerabilities affecting various products, including Cisco IOS XR Software, Crosswork Network Services Orc ... Read more

Published Date: Sep 12, 2024 (10 months, 3 weeks ago)
CVE-2024-20489 CVE-2024-20483 CVE-2024-20398 CVE-2024-20381 CVE-2024-20304 CVE-2024-40766 CVE-2024-7971 CVE-2024-43399 CVE-2024-7646
  • Cybersecurity News
CVE-2024-8522 (CVSS 10): LearnPress SQLi Flaw Leaves 90K+ WordPress Sites at Risk

A critical SQL injection vulnerability has been discovered in LearnPress, a popular WordPress plugin used to create and manage online courses. The flaw, tracked as CVE-2024-8522, carries a maximum CVS ... Read more

Published Date: Sep 12, 2024 (10 months, 3 weeks ago)
CVE-2024-8522 CVE-2024-6342 CVE-2024-7971 CVE-2024-7965 CVE-2023-31315 CVE-2024-38202 CVE-2024-21302 CVE-2024-3080
  • schneier.com
New Chrome Zero-Day

Blog Newsletter Books Essays News Talks Academic About Me HomeBlog New Chrome Zero-Day According to Microsoft researchers, North Korean hackers have been using a Chrome zero-day exploit to steal crypt ... Read more

Published Date: Sep 10, 2024 (10 months, 3 weeks ago)
CVE-2024-7971
  • Cybersecurity News
ECDSA Vulnerability in YubiKey: What You Need to Know

OLYMPUS DIGITAL CAMERAIn a recent security advisory, Yubico disclosed a moderate vulnerability (CVE-2024-45678) affecting several of its hardware security devices, including the widely-used YubiKey 5 ... Read more

Published Date: Sep 05, 2024 (10 months, 4 weeks ago)
CVE-2024-45678 CVE-2024-7971 CVE-2024-7965 CVE-2023-31315 CVE-2024-38202 CVE-2024-21302 CVE-2024-3080 CVE-2024-31497 CVE-2024-31498
  • europa.eu
Cyber Brief 24-09 - August 2024

Cyber Brief (August 2024)September 4, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 249 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, in Europe, th ... Read more

Published Date: Sep 04, 2024 (10 months, 4 weeks ago)
CVE-2024-40766 CVE-2024-7971 CVE-2024-5914 CVE-2024-28986 CVE-2024-7593 CVE-2024-41730 CVE-2024-38200 CVE-2024-22116 CVE-2023-31315 CVE-2024-1305 ...+3 more CVE
  • Cybersecurity News
CVE-2024-38106: 0-Day Windows Kernel Vulnerability Exploited in the Wild, PoC Published

Recently, security researcher Sergey Kornienko from PixiePoint Security published an analysis and proof-of-concept (PoC) exploit for a critical zero-day vulnerability in the Windows Kernel, identified ... Read more

Published Date: Sep 04, 2024 (10 months, 4 weeks ago)
CVE-2024-7971 CVE-2024-28000 CVE-2024-38106 CVE-2024-43360 CVE-2024-7029 CVE-2024-27182 CVE-2024-27181 CVE-2024-20419 CVE-2024-21412
  • Dark Reading
North Korean APT Exploits Novel Chromium, Windows Bugs to Steal Crypto

Source: Piotr Malczyk via Alamy Stock PhotoA threat actor belonging to North Korean intelligence burned two novel vulnerabilities last month in an attempt to steal from the cryptocurrency industry.Mos ... Read more

Published Date: Sep 03, 2024 (10 months, 4 weeks ago)
CVE-2024-7971 CVE-2024-38106
  • TheCyberThrone
TheCyberThrone CyberSecurity Newsletter Top 5 Articles – August, 2024

Welcome to TheCyberThrone cybersecurity month in review will be posted covering the important security happenings . This review is for the month ending August, 2024Subscribers favorite #1Velvet Ant AP ... Read more

Published Date: Sep 01, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-33536 CVE-2024-33535 CVE-2024-33533 CVE-2024-20399 CVE-2024-23897 CVE-2023-22527
  • security.nl
Google Chrome-gebruikes via drive-by download besmet met rootkit

zondag 1 september 2024, 08:24 door Redactie, 3 reactiesLaatst bijgewerkt: Gisteren, 10:23 Gebruikers van Google Chrome zijn door middel van een drive-by download besmet met een rootkit, zo stelt Micr ... Read more

Published Date: Sep 01, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-38106
  • security.nl
Google Chrome-gebruikers via drive-by download besmet met rootkit

zondag 1 september 2024, 08:24 door Redactie, 3 reactiesLaatst bijgewerkt: Gisteren, 10:23 Gebruikers van Google Chrome zijn door middel van een drive-by download besmet met een rootkit, zo stelt Micr ... Read more

Published Date: Sep 01, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-38106
  • TheCyberThrone
North Korean Citrine Sleet behind CVE-2024-7971 exploitation

Microsoft’s threat intelligence team discovered that a known North Korean threat actor exploiting a Chrome remote code execution flaw patched by Google earlier this month.The vulnerability, tracked as ... Read more

Published Date: Sep 01, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-38106 CVE-2023-22527
  • TheCyberThrone
Fortra fixes vulnerabilities in FileCatalyst Workflow

Fortra has released patches for two vulnerabilities in FileCatalyst Workflow impacts version  5.1.6 Build 139 and earlier.The first vulnerability tracked as CVE-2024-6633 with a CVSS score of 9.8 is d ... Read more

Published Date: Aug 31, 2024 (11 months ago)
CVE-2024-6633 CVE-2024-6632 CVE-2024-7971 CVE-2023-22527
  • The Hacker News
North Korean Hackers Deploy FudModule Rootkit via Chrome Zero-Day Exploit

Rootkit / Threat Intelligence A recently patched security flaw in Google Chrome and other Chromium web browsers was exploited as a zero-day by North Korean actors in a campaign designed to deliver the ... Read more

Published Date: Aug 31, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-38193 CVE-2024-38106 CVE-2024-5274 CVE-2024-4947 CVE-2024-21338
  • TheCyberThrone
APT29 compromised Mongolia with NSO and Intellexa tools

Google’s Threat Analysis Group has uncovered that Russian government-backed APT29 hackers targetting Mongolian government websites using exploits strikingly similar to those developed by commercial sp ... Read more

Published Date: Aug 31, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-5274 CVE-2024-4671 CVE-2023-22527 CVE-2023-41993
  • Cybersecurity News
CVE-2024-7971: North Korean APT Citrine Sleet Exploits Chromium Zero-Day

In a recent cybersecurity report, Microsoft Threat Intelligence has revealed that a North Korean threat actor, believed to be Citrine Sleet, has been actively exploiting a zero-day vulnerability (CVE- ... Read more

Published Date: Aug 31, 2024 (11 months ago)
CVE-2024-40766 CVE-2024-7971 CVE-2024-42815 CVE-2024-42472 CVE-2024-38106 CVE-2024-6915 CVE-2023-42793
  • The Cyber Express
North Korean Hackers Exploited Chromium Zero-Day to Deploy Rootkit

In a recent attack, a North Korean threat actor leveraged a zero-day vulnerability in Google’s Chromium browser to deploy the FudModule rootkit, targeting cryptocurrency firms for financial gain. Micr ... Read more

Published Date: Aug 30, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-38106 CVE-2024-4885 CVE-2024-21338 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882
  • BleepingComputer
North Korean hackers exploit Chrome zero-day to deploy rootkit

North Korean hackers have exploited a recently patched Google Chrome zero-day (CVE-2024-7971) to deploy the FudModule rootkit after gaining SYSTEM privileges using a Windows Kernel exploit. "We assess ... Read more

Published Date: Aug 30, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-38193 CVE-2024-38106
  • TheCyberThrone
Atlassian flaw CVE-2023-22527 exploited in Cryptomining campaigns

The critical template injection vulnerability in the Atlassian Confluence Data Center and Confluence Server is being actively exploited for cryptojacking campaigns that allow remote attackers to execu ... Read more

Published Date: Aug 30, 2024 (11 months ago)
CVE-2024-7971 CVE-2023-22527
  • TheCyberThrone
CISA adds CVE-2024-7965 Chrome bug to its KEV catalog

The U.S. CISA added Google Chrome vulnerability to its Known Exploited Vulnerability Catalog following the mass exploitation in the wild.CVE-2024-7965; Google Chromium V8 contains an inappropriate imp ... Read more

Published Date: Aug 29, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-7965 CVE-2023-22527
  • TheCyberThrone
APT-C-60 Exploits WPS Office Vulnerabilities

Security researchers from ESET have identified two vulnerabilities in WPS Office for Windows, widely exploited by the APT-C-60 cyberespionage group, which is aligned with South Korea.APT-C-60, known f ... Read more

Published Date: Aug 29, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-7263 CVE-2024-7262 CVE-2023-22527
  • TheCyberThrone
RockWell Automation fixes Several vulnerabilities

Rockwell Automation has released patches for multiple vulnerabilities discovered in its ThinManager ThinServer software. These vulnerabilities, pose significant risks to systems running affected versi ... Read more

Published Date: Aug 29, 2024 (11 months ago)
CVE-2024-7988 CVE-2024-7987 CVE-2024-7986 CVE-2024-7971 CVE-2023-22527
  • TheCyberThrone
WordPress WPML Plugin Critical Vulnerability CVE-2024-6386

Researchers have uncovered a critical vulnerability in WPML multilingual CMS Plugin for WordPress that leads to a Remote Code Execution, which potentially allows the compromise of impacted websites.Th ... Read more

Published Date: Aug 28, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-6386 CVE-2024-38856 CVE-2023-22527
  • TheCyberThrone
CISA adds Apache OFBiz Vulnerability CVE-2024-38856 to KEV Catalog

The U.S. CISA adds Apache OFBiz vulnerability to its KEV catalog following the mass exploitationCVE-2024-38856 : Apache OFBiz Incorrect Authorization Vulnerability: Apache OFBiz contains an incorrect ... Read more

Published Date: Aug 28, 2024 (11 months ago)
CVE-2024-7971 CVE-2024-6386 CVE-2024-38856 CVE-2023-22527
  • The Cyber Express
Critical Chrome Zero-Day Vulnerability (CVE-2024-7965) Requires Immediate User Action

Google recently addressed a critical zero-day vulnerability in its Chrome browser, identified as CVE-2024-7965. This high-severity flaw, affecting versions of Chrome prior to 128.0.6613.84, has been a ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-4885 CVE-2024-5274 CVE-2024-4947 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-21893 ...+5 more CVE
  • security.nl
Google meldt actief misbruik van V8-kwetsbaarheid in Chrome

Aanvallers maken actief misbruik van een kwetsbaarheid in Chrome waar op 21 augustus een update voor verscheen. Het beveiligingslek, aangeduid als CVE-2024-7965, bevindt zich in V8, de JavaScript-engi ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965
  • The Hacker News
Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation

Vulnerability / Browser Security Google has revealed that a security flaw that was patched as part of a software update rolled out last week to its Chrome browser has come under active exploitation in ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519
  • TheCyberThrone
CISA adds CV-2024-7971 to its KEV Catalog

The US CISA has added Google Chrome vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-7971 Google Chromium V8 contains a type of confusion ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2023-22527
  • Cybersecurity News
Google Chrome Faces Double Blow with New Zero-Day Flaw Exploits: CVE-2024-7965 and CVE-2024-7971

In a significant update to its security advisory, Google has confirmed that CVE-2024-7965, a high-severity zero-day vulnerability in the Chrome browser, has been actively exploited in the wild. This r ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-43202 CVE-2024-38063 CVE-2023-45614
  • TheCyberThrone
Google addressed 10th Zeroday in Chrome CVE-2024-7965

Google has released a patch to address a new Chrome zero-day vulnerability that is actively exploited.The vulnerability tracked as CVE-2024-7965 with a CVSS score of 8.8 is an inappropriate implementa ... Read more

Published Date: Aug 27, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-4671 CVE-2023-22527
  • BleepingComputer
Google tags a tenth Chrome zero-day as exploited this year

Today, Google revealed that it patched the tenth zero-day exploited in the wild in 2024 by attackers or security researchers during hacking contests. Tracked as CVE-2024-7965 and reported by a securit ... Read more

Published Date: Aug 26, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519
  • TheCyberThrone
CISA adds Versa Networks Flaw CVE-2024-39717 to its KEV Catalog

The U.S. CISA has added CVE-2024-39717 to its Know exploited vulnerability catalog following the massive exploitation evidenceThis vulnerability CVE-2024-39717 affects Versa Networks’ Director GUI, sp ... Read more

Published Date: Aug 26, 2024 (11 months, 1 week ago)
CVE-2024-39717 CVE-2024-7971 CVE-2024-6800 CVE-2023-22527
  • Cybersecurity News
Critical Flaw Discovered in Popular Python Library Pandas

Information Stealer Malware on the Rise: ACSC Issues Urgent Cybersecurity WarningThe Australian Cyber Security Centre (ACSC) has issued a warning about the escalating threat of information stealer mal ... Read more

Published Date: Aug 26, 2024 (11 months, 1 week ago)
CVE-2024-45488 CVE-2024-6670 CVE-2024-7971 CVE-2024-28000 CVE-2024-38106 CVE-2024-43360 CVE-2024-43044 CVE-2024-7029 CVE-2024-27182 CVE-2024-27181 ...+2 more CVE
  • The Register
Alleged Karakut ransomware scumbag charged in US

Infosec in brief Deniss Zolotarjovs, a suspected member of the Russian Karakurt ransomware gang, has been charged in a US court with allegedly conspiring to commit money laundering, wire fraud and Hob ... Read more

Published Date: Aug 26, 2024 (11 months, 1 week ago)
CVE-2024-7971
  • TheCyberThrone
GitHub fixes several vulnerabilities including CVE-2024-6800

GitHub has addressed several vulnerabilities in GitHub Enterprise Server (GHES) that could have allowed attackers to gain unauthorized access and manipulate repositories.The most critical vulnerabilit ... Read more

Published Date: Aug 25, 2024 (11 months, 1 week ago)
CVE-2024-39717 CVE-2024-7971 CVE-2024-7711 CVE-2024-6800 CVE-2024-6337 CVE-2024-38054 CVE-2023-22527
  • Help Net Security
Week in review: PostgreSQL databases under attack, new Chrome zero-day actively exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: PostgreSQL databases under attack Poorly protected PostgreSQL databases running on Linux machines are ... Read more

Published Date: Aug 25, 2024 (11 months, 1 week ago)
CVE-2024-28987 CVE-2024-7971 CVE-2024-6800 CVE-2024-28986 CVE-2024-38193
  • TheCyberThrone
PoC Exploit for Microsoft bug CVE-2024-38054 released

Security researcher ‘Frost’ has released proof-of-concept exploit code for the high-severity vulnerability in the Kernel Streaming WOW Thunk Service Driver could enable local attackers to escalate pri ... Read more

Published Date: Aug 25, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-6800 CVE-2024-38054 CVE-2024-20399 CVE-2023-22527
  • TheCyberThrone
Velvet Ant APT exploits Cisco bug CVE-2024-20399

Security researchers discovered that the China-linked APT group Velvet Ant has exploited the recently disclosed zero-day CVE-2024-20399 in Cisco switches to take over the network devices.Last month, C ... Read more

Published Date: Aug 24, 2024 (11 months, 1 week ago)
CVE-2024-28987 CVE-2024-7971 CVE-2024-38054 CVE-2024-20399 CVE-2023-22527
  • TheCyberThrone
SolarWinds fixes CVE-2024-28987 in WHD Product

SolarWinds has released an update to a new security flaw in its Web Help Desk (WHD) software that could allow remote unauthenticated attackers to gain unauthorized access to vulnerable instances.The v ... Read more

Published Date: Aug 24, 2024 (11 months, 1 week ago)
CVE-2024-40766 CVE-2024-28987 CVE-2024-7971 CVE-2024-28986 CVE-2024-20399 CVE-2023-22527
  • TheCyberThrone
Sonicwall fixes CVE-2024-40766 in SonicOS

SonicWall has released patch for a critical vulnerability  affecting their SonicOS and could allow unauthorized access to SonicWall firewalls, potentially leading to a complete system compromise.The v ... Read more

Published Date: Aug 24, 2024 (11 months, 1 week ago)
CVE-2024-40766 CVE-2024-28987 CVE-2024-7971 CVE-2023-22527
  • TheCyberThrone
Microsoft fixes Zeroday vulnerability CVE-2024-7971 in EDGE Browser

Microsoft has released patches for a critical vulnerability in EDGE Browser that is currently being exploited by malicious actors.This zero-day flaw, tracked as CVE-2024-7971, exists within Google Chr ... Read more

Published Date: Aug 23, 2024 (11 months, 1 week ago)
CVE-2024-41879 CVE-2024-38207 CVE-2024-38210 CVE-2024-38209 CVE-2024-38208 CVE-2024-7971 CVE-2023-22527
  • Cybersecurity News
Urgent Edge Security Update: Microsoft Patches Zero-day & RCE Vulnerabilities

Microsoft has released an urgent security update for its Edge browser, patching a critical vulnerability that is currently being exploited by malicious actors. This zero-day flaw, tracked as CVE-2024- ... Read more

Published Date: Aug 23, 2024 (11 months, 1 week ago)
CVE-2024-38210 CVE-2024-38209 CVE-2024-7971 CVE-2024-42005 CVE-2024-38529 CVE-2024-37906 CVE-2023-22527 CVE-2023-36735 CVE-2023-27532
  • Dark Reading
Google Chrome Update Fixes Flaw Exploited in the Wild

Source: imageBROKER.com GmbH & Co. KG via Alamy Stock PhotoNew security fixes are being rolled out to address a high-severity vulnerability found in Google's Chrome browser.The flaw, tracked as CVE-20 ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971
  • TheCyberThrone
CISA adds multiple vulnerabilities to its KEV catalog

The U.S. CISA has added 4 vulnerabilities to it’d Known Exploited Vulnerabilities Catalog (KEV) belongs to Dahua, Microsoft, and Linux products based on the mass exploitationCVE-2022-0185Linux Kernel ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2023-22527 CVE-2022-0185 CVE-2021-33045 CVE-2021-33044 CVE-2021-31196
  • TheCyberThrone
Google fixes ninth Zeroday CVE-2024-7971 in Chrome

Google released an emergency security update to address a Chrome zero-day vulnerability, tracked as CVE-2024-7971, that is actively exploited.The vulnerability is a type confusion issue that resides i ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-38810 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519 ...+1 more CVE
  • Help Net Security
New Chrome zero-day actively exploited, patch quickly! (CVE-2024-7971)

A new Chrome zero-day vulnerability (CVE-2024-7971) exploited by attackers in the wild has been fixed by Google. About CVE-2024-7971 CVE-2024-7971 is a high-severity vulnerability caused by a type con ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965
  • The Hacker News
Google Fixes High-Severity Chrome Flaw Actively Exploited in the Wild

Browser Security / Vulnerability Google has rolled out security fixes to address a high-severity security flaw in its Chrome browser that it said has come under active exploitation in the wild. Tracke ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519
  • Cybersecurity News
Urgent Chrome Update: Active Zero-Day Exploit Detected (CVE-2024-7971)

Google has released an urgent Chrome update (version 128.0.6613.84/85) in response to an actively exploited zero-day vulnerability (CVE-2024-7971). This vulnerability, categorized as a type confusion ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-6633 CVE-2024-7971 CVE-2024-7965 CVE-2024-7964 CVE-2024-34102
  • TheCyberThrone
Spring Security fixes CVE-2024-38810

A high-severity flaw has been discovered in Spring Security, potentially allowing unauthorized access to sensitive data within affected applications.Spring Security’s powerful method security features ... Read more

Published Date: Aug 22, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-21689 CVE-2024-38810 CVE-2023-22527
  • BleepingComputer
Google fixes ninth Chrome zero-day exploited in attacks this year

​​Today, Google released a new Chrome emergency security update to patch a zero-day vulnerability tagged as exploited in attacks. "Google is aware that an exploit for CVE-2024-7971 exists in the wild, ... Read more

Published Date: Aug 21, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519
  • BleepingComputer
Google fixes ninth Chrome zero-day tagged as exploited this year

​​Today, Google released a new Chrome emergency security update to patch a zero-day vulnerability tagged as exploited in attacks. "Google is aware that an exploit for CVE-2024-7971 exists in the wild, ... Read more

Published Date: Aug 21, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-5274 CVE-2024-4947 CVE-2024-4761 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-0519
  • TheCyberThrone
Atlassian fixes CVE-2024-21689 vulnerability in Bamboo

Atlassian has issued a patch for a high severity vulnerability in its Bamboo Data Center and Server products, which is a Remote Code Execution.The vulnerability tracked as CVE-2024-21689 with a CVSS s ... Read more

Published Date: Aug 21, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-21689 CVE-2024-38810 CVE-2023-22527
  • Cybersecurity News
CVE-2024-7272: Critical Heap Overflow Vulnerability Discovered in FFmpeg, PoC Published

A critical security vulnerability, identified as CVE-2024-7272, has been uncovered in FFmpeg, the world’s leading multimedia framework renowned for its ability to decode, encode, and stream nearly any ... Read more

Published Date: Aug 21, 2024 (11 months, 1 week ago)
CVE-2024-7971 CVE-2024-7965 CVE-2024-7272 CVE-2023-31315 CVE-2024-38202 CVE-2024-21302 CVE-2024-22862 CVE-2024-22860 CVE-2022-2566
  • TheCyberThrone
Microsoft Flaw CVE-2024-38193 exploited by Lazarus Group

During this month patch Tuesday, microsoft addressed nearly 90 flaws, some of which have already been exploited by hackers.One specific vulnerability, CVE-2024-38193 with a CVSS score of 7.8, is a  Br ... Read more

Published Date: Aug 20, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-38193 CVE-2023-22527
  • TheCyberThrone
F5 fixes NGINX and BIG-IP Vulnerabilities

F5 has recently released security advisories addressing vulnerabilities in its products. These vulnerabilities, if exploited, could lead to denial-of-service (DoS) attacks and unauthorized access, dis ... Read more

Published Date: Aug 20, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-39809 CVE-2024-39792 CVE-2024-38193 CVE-2024-23897 CVE-2023-22527
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 20, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-2024 CVE-2024-23897 CVE-2023-22527 CVE-2023-43770
  • Cybersecurity News
PoC Exploit for Windows 0-Day Flaws CVE-2024-38202 and CVE-2024-21302 Released

Researchers have published the technical details and proof-of-concept (PoC) exploit code for two critical zero-day vulnerabilities in Windows, tracked as CVE-2024-38202 and CVE-2024-21302. These vulne ... Read more

Published Date: Aug 20, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-7965 CVE-2023-31315 CVE-2024-38202 CVE-2024-21302
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 19, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-2024 CVE-2024-23897 CVE-2023-22527 CVE-2023-43770
  • TheCyberThrone
PoC for IvantiTM vulnerability CVE-2024-7593 released

To limit the exploitability of this vulnerability, Ivanti recommends limiting Admin Access to the Management Interface internal to the network through the private / corporate network.The researchers a ... Read more

Published Date: Aug 19, 2024 (11 months, 2 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-23897 CVE-2023-22527 CVE-2023-35082

The following table lists the changes that have been made to the CVE-2024-7971 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Reanalysis by [email protected]

    Jan. 03, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:* versions up to (excluding) 128.0.2739.42
    Changed Reference Type https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/ Exploit, Third Party Advisory https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/ Exploit, Patch, Third Party Advisory, Vendor Advisory
  • Modified Analysis by [email protected]

    Nov. 27, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    Removed CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/ No Types Assigned https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/ Exploit, Third Party Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Aug. 27, 2024

    Action Type Old Value New Value
    Added Vulnerability Name Google Chromium V8 Type Confusion Vulnerability
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    Added Due Date 2024-09-16
    Added Date Added 2024-08-26
  • Initial Analysis by [email protected]

    Aug. 26, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html No Types Assigned https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html Release Notes
    Changed Reference Type https://issues.chromium.org/issues/360700873 No Types Assigned https://issues.chromium.org/issues/360700873 Permissions Required
    Added CWE NIST CWE-843
    Added CPE Configuration OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 128.0.6613.84
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 22, 2024

    Action Type Old Value New Value
    Added CWE CISA-ADP CWE-843
    Added CVSS V3.1 CISA-ADP AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE Received by [email protected]

    Aug. 21, 2024

    Action Type Old Value New Value
    Added Description Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
    Added Reference Chrome https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html [No types assigned]
    Added Reference Chrome https://issues.chromium.org/issues/360700873 [No types assigned]
    Added CWE Chrome CWE-843
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-7971 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-7971 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: