Vulnerabilities & Threats that Matter 11-17 July 2022

Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 580 37 2 World-wide 11 61 For a detailed threat digest, download the pdf file here Summary The second week of July 2022 witnessed the discovery of 580 vulnerabilities out ...

CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication. Recent assessments: gwillcox-r7 at October 25, 2022 5:15pm UTC reported: This was...

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Trellix · July 19, 2022 This blog was also written by Chintan Shah Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned...

CVE-2022-1565

creationtimestamp| type| source ---|---|--- 2022-07-18 20:39:52+00:00| seen| https://t.me/cibsecurity/46478 2023-03-29 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51122...

CVE-2022-33891

creationtimestamp| type| source ---|---|--- 2022-07-18 12:34:21+00:00| seen| https://t.me/cibsecurity/46426 2022-07-19 10:27:13+00:00| published-proof-of-concept| https://t.me/proxybar/921 2022-07-19 12:06:25+00:00| published-proof-of-concept| https://t.me/MrVGunz/340 2022-07-19 12:12:47+00:00|...

Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems

Summary Actions to take today: • Install fixed builds, updating all affected VMware Horizon and UAG systems to the latest versions. If updates or workarounds were not promptly applied following VMware’s release of updates for Log4Shell in December 2021,treat all affected VMware systems as...

A week in security (July 11 – July 17)

Last week on Malwarebytes Labs: Elden Ring maker Bandai Namco hit by ransomware and data leaks Predatory Sparrow massively disrupts steel factories while keeping workers safe New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs China’s Tonto Team increases...

CVE-2019-11248

creationtimestamp| type| source ---|---|--- 2022-07-18 03:11:02+00:00| published-proof-of-concept| https://t.me/ctinow/55552 2024-10-03 01:20:50+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/8661 2024-11-10 00:00:00+00:00| exploited| The Shadowserver...

CVE-2021-24284

creationtimestamp| type| source ---|---|--- 2022-07-15 13:33:55+00:00| exploited| https://t.me/itsecnews/1013 2022-07-19 20:21:54+00:00| exploited| https://t.me/truesecator/3194 2022-08-13 21:01:30+00:00| seen| https://t.me/poxek/2211 2024-01-08 14:56:27+00:00| seen| https://t.me/arpsyndicate/265...

Siemens RUGGEDCOM ROS Code Injection Vulnerability

RUGGEDCOM ROS-based devices, typically switches and serial-to-Ethernet devices, are used to connect devices operating in harsh environments, such as power substations and traffic control cabinets.A code injection vulnerability exists in Siemens RUGGEDCOM ROS, which could be exploited by an attack...

Siemens PADS Standard/Plus Viewer Stack Corruption Vulnerability (CNVD-2022-51606)

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.A stack corruption vulnerability exists in Siemens PADS Standard/Plus Viewer, which can be exploited by an attacker to disclose information in the context of the curre...

Siemens PADS Standard/Plus Viewer Out-of-Bounds Reading Vulnerability (CNVD-2022-51618)

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds read vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Siemens PADS Standard/Plus Viewer Out-of-Bounds Writing Vulnerability (CNVD-2022-51613)

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds write vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Siemens PADS Standard/Plus Viewer Out-of-Bounds Reading Vulnerability (CNVD-2022-51619)

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds read vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Siemens PADS Standard/Plus Viewer Out-of-Bounds Writing Vulnerability (CNVD-2022-51623)

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds write vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Product Show Room Site SQL Injection Vulnerability (CNVD-2022-77046)

Product Show Room Site is a product showroom website from Carlo Montero's personal developer. Product Show Room Site v1.0 is vulnerable to SQL injection, which originates from a SQL injection in the /psrs/classes/Master.php?f=deleteproduct The vulnerability is caused by SQL injection of the id...

Mattermost Default Configuration Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...

IBM QRadar SIEM Denial of Service Vulnerability (CNVD-2022-56976)

IBM QRadar SIEM is a U.S.-based solution from IBM that leverages security intelligence to protect assets and information from advanced threats. The solution provides monitoring of the entire scope of the IT architecture, generating detailed reports on data access and user activity, etc. A...

CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

Siemens SICAM GridEdge Access Control Error Vulnerability

SICAM GridEdge can make your existing IEC61850 devices IoT capable with just a few clicks.An access control error vulnerability exists in Siemens SICAM GridEdge, which could be exploited by an attacker with access to the file system of the host computer running SICAM GridEdge to inject a custom S...