ShellBot Malware Evades Detection Using Hexadecimal IP Addresses

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ShellBot malware, targeting poorly managed Linux SSH servers, now employs hexadecimal IP addresses in its download URLs to evade detection. This change highlights the need for strong security measures an...

ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers

The threat actors behind ShellBot are leveraging IP addresses transformed into their hexadecimal notation to infiltrate poorly managed Linux SSH servers and deploy the DDoS malware. "The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed...

Endpoint Management - How to load balance Exchange Servers

Steps to set up load balancing for Exchange Servers in Endpoint Management to ensure high availability and seamless user experiences...

CVE-2023-39325 HTTP/2 rapid reset can cause excessive work in net/http

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

An issue was discovered in Python before 3.8.18 3.9.x before 3.9.18 3.10.x before 3.10.13 and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created receives data into the socket buffer and then is closed quickly there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

...

Exploit for Uncontrolled Resource Consumption in Ietf Http

This is a proof of concept for a Denial of Service DoS exploit...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2023-98176)

IBM Content Navigator is a Web client from International Business Machines IBM. The product supports searching and processing documents stored in content servers from a Web browser. IBM Content Navigator suffers from a cross-site scripting vulnerability that stems from the application's lack of...

The vulnerability in the web interface of Supermicro X11 series BMC IPMI servers involves insufficient protection of the website structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability in the web interface of BMC IPMI Supermicro X11 series servers exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted GET requests...

The vulnerability in the web interface of BMC IPMI Supermicro X11 servers exists due to the lack of protective measures for the web page structure. This allows attackers to execute XSS attacks.

The vulnerability in the web interface of BMC IPMI Supermicro X11 series servers exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted GET requests...

CVE-2023-44487 HTTP/2 Rapid Reset Attack

Today, Amazon Web Services, Cloudflare, and Google, in a coordinated announcement, reveal their experiences mitigating powerful HTTP/2-based DDoS attacks utilizing a zero-day technique referred to as Rapid Reset, documented under the vulnerability identifier CVE-2023-44487. The attack magnitudes...

Microsoft Win32K Security Vulnerability

Microsoft Win32k is a system file for Windows multi-user management from Microsoft USA. A security vulnerability exists in Microsoft Windows Win32K. An attacker could exploit the vulnerability to elevate privileges. The following products and editions are affected: Windows Server 2012 R2,Windows...

Microsoft Windows Remote Desktop Protocol Security Vulnerability

Microsoft Windows Remote Desktop Protocol RDP is an application for connecting to remote Windows desktops from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Remote Desktop Protocol. An attacker exploiting this vulnerability could gain access to sensitive...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent lies in errors during link processing, which allows attackers to exploit their privileges.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent is related to errors in handling links. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent is related to authentication errors. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent, related to authentication errors, allows attackers to escalate their privileges.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent is related to authentication errors. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent allows attackers to gain unauthorized access to protected information.

Acronis Agent’s backup and recovery software for computers and servers involves exposing protected information. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

ansible-freeipa bug fix update

An update is available for ansible-freeipa. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ansible-freeipa packages provide roles and playbooks to deploy...

AlmaLinux 8 : python3.11 (ALSA-2023:5463)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5463 advisory. - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP...

Zope Information Disclosure Vulnerability (GHSA-8xv7-89vj-q48c)

Zope is prone to an information disclosure vulnerability through Python SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zope:zope...