CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center ASEC, in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on...

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center ASEC, in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on...

SYS01 Stealer Targets Government and Manufacturing Industry

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The SYS01 stealer has been targeting critical government infrastructure employees, manufacturing companies, and other industries, and using various delivery technique...

Atlassian Jira < 8.5.5 DLL Hijacking

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.7.0. It is, therefore, affected by a vulnerability which permits when deployed onto the Windows operating system environment which allows local system attackers who ha...

Atlassian Confluence < 7.4.10 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Confluence 7.1.x < 7.12.3 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Jira 8.6.0 < 8.7.2 DLL Hijacking

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.7.0. It is, therefore, affected by a vulnerability which permits when deployed onto the Windows operating system environment which allows local system attackers who ha...

CVE-2023-25147

CVE-2023-25147 affects Trend Micro Apex One agent. Affected component: Apex One agent during a specific update process, where a attacker with prior admin rights can bypass protection by using a crafted DLL. Impact aligns with confusion from multiple sources: local privilege escalation and protect...

CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

SYS01stealer: New Threat Using Facebook Ads to Target Critical Infrastructure Firms

Cybersecurity researchers have discovered a new information stealer dubbed SYS01stealer targeting critical government infrastructure employees, manufacturing companies, and other sectors since November 2022. "The threat actors behind the campaign are targeting Facebook business accounts by using...

PT-2023-19937 · Trend Micro · Trend Micro Apex One

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Description: The issue allows an attacker with previously acquired administrative rights to bypass protection by using a specifically crafted DLL during a specific update process. It is not...

Atlassian Confluence < 7.0.5 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.5 or 7.1.x prior to 7.1.1. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows local system attackers who have...

Atlassian Confluence 7.1.x < 7.1.1 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.5 or 7.1.x prior to 7.1.1. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows local system attackers who have...

Cortex-XDR-Config-Extractor - Cortex XDR Config Extractor

This tool is meant to be used during Red Team Assessments and to audit the XDR Settings. With this tool its possible to parse the Database Lock Files of the Cortex XDR Agent by Palo Alto Networks and extract Agent Settings, the Hash and Salt of the Uninstall Password, as well as possible...

Schneider Electric EcoStruxure Machine Expert Injection (CVE-2020-7489)

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability exists on EcoStruxure Machine Expert Basic or SoMachine Basic programming software versions in security notification. The result of this vulnerability, DLL substitution, could...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Trend Micro’s Managed Extended Detection and Response MxDR team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX...