Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control

Summary Update June 2, 2022: This Cybersecurity Advisory CSA has been updated with additional indicators of compromise IOCs and detection signatures, as well as tactics, techniques, and procedures TTPs from trusted third parties. Update End The Cybersecurity and Infrastructure Security Agency CIS...

Microsoft collaborates with Tenable to support federal cybersecurity efforts

On May 12, 2021, the White House issued Presidential Executive Order EO 14028 to establish cybersecurity as a national priority.1 As part of this effort, the White House has called for greater public and private sector collaboration to address the evolving threats facing federal agencies. In the...

Microsoft collaborates with Tenable to support federal cybersecurity efforts

On May 12, 2021, the White House issued Presidential Executive Order EO 14028 to establish cybersecurity as a national priority.1 As part of this effort, the White House has called for greater public and private sector collaboration to address the evolving threats facing federal agencies. In the...

CISA Updates Advisory on Threat Actors Chaining Unpatched VMware Vulnerabilities

CISA has updated Cybersecurity Advisory AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control, originally released May 18, 2022. The advisory has been updated to include additional indicators of compromise and detection signatures, as well as tactics,...

Atlassian Releases Security Advisory for Confluence Server and Data Center, CVE-2022-26134

Atlassian has released a security advisory to address a remote code execution vulnerability CVE-2022-26134 affecting Confluence Server and Data Center products. An unauthenticated remote attacker could exploit this vulnerability to execute code remotely. Atlassian reports that there is known...

CISA Adds One Known Exploited Vulnerability (CVE-2022-26134) to Catalog  

CISA has added one new vulnerability—CVE-2022-26134—to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view t...

CISA Releases Security Advisory on Illumina Local Run Manager

CISA has released an Industrial Controls Systems Advisory ICSA detailing multiple vulnerabilities in Illumina Local Run Manager. Successful exploitation of these vulnerabilities may allow an unauthenticated malicious actor to take control of the affected product remotely and take any action at th...

Karakurt Data Extortion Group

CISA, the Federal Bureau of Investigation FBI, the Department of Treasury, and the Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory CSA to provide information on the Karakurt data extortion group. Karakurt actors steal data and threaten to auction it off or...

Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisories for Firefox...

Microsoft Releases Workaround Guidance for MSDT "Follina" Vulnerability

Microsoft has released workaround guidance to address a remote code execution RCE vulnerability—CVE-2022-30190, known as "Follina"—affecting the Microsoft Support Diagnostic Tool MSDT in Windows. A remote, unauthenticated attacker could exploit this vulnerability to take control of an affected...

Fuji Electric Alpha7 PC Loader

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Alpha7 PC Loader Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED...

QNAP QuTS hero Privilege Escalation Vulnerability (QSA-22-05)

QNAP QuTS hero is prone to a local privilege escalation vulnerability, also known as dirty pipe. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Microsoft Patch Tuesday May 2022: Edge RCE, PetitPotam LSA Spoofing, bad patches

Hello everyone! This episode will be about Microsoft Patch Tuesday for May 2022. Sorry for the delay, this month has been quite intense. As usual, Im using my Vulristics project and going through not only the vulnerabilities that were presented on May 10th, but all the MS vulnerabilities presente...

Hacktivists Expanding DDoS Attacks as Part of International Cyber Warfare Strategy

In April 2022 it was reported that pro-Russian hacktivist group, KILLNET, carried out a series of Distributed Denial of Service DDoS attacks against a number of websites including the United Nations UN, The Organization for Security and Cooperation OSCE an organization founded in Finland, and oth...

Cisco IOS XR Software Health Check Open Port (cisco-sa-iosxr-redis-ABJyE5xK)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability in the health check RPM due to a port that is open by default. An unauthenticated, remote attacker can exploit this, by connecting to the Redis instance on the open port, in order to read and write information...

CISA and DoD Release 5G Security Evaluation Process Investigation Study

CISA and the Department of Defense DoD have released their 5G Security Evaluation Process Investigation Study for federal agencies. The new features, capabilities, and services offered by fifth-generation 5G cellular network technology can transform mission and business operations; and federal...

Keysight N6854A Geolocation server and N6841A RF Sensor software

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Keysight Technologies, Inc. Equipment: N6854A Geolocation server and N6841A RF Sensor software Vulnerabilities: Relative Path Traversal, Deserialization of Untrusted Data 2. RISK EVALUATION Successful...

Horner Automation Cscape Csfont

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Horner Automation Equipment: Cscape Csfont Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to...

Citrix Releases Security Updates for ADC and Gateway

Citrix has released security updates to address vulnerabilities in ADC and Gateway. An attacker could exploit these vulnerabilities to cause a denial-of-service condition. CISA encourages users and administrators to review Citrix Security Update CTX457048 and apply the necessary updates. This...

Drupal Releases Security Updates

Drupal has released security updates to address a vulnerability that does not affect Drupal core but may affect some contributed projects or custom code on Drupal sites. Exploitation of this vulnerability could allow a remote attacker to take control of an affected website. CISA encourages users...