Fedora 37 : java-11-openjdk-portable (2023-0ab3a5423f)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0ab3a5423f advisory. Updatings portables to ajva April security update, with few enhancements be properly repacked. Tenable has extracted the preceding description block directly...

KLA49155 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote...

KLA49157 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in SysInternals Sysmon for Windows can be...

KLA49156 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, execute arbitrary code, cause denial of service. Below is a complete list of...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2023-1829)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Netlogon RPC Elevation of Privilege Vulnerability CVE-2022-38023 Note that Tenable Network Security has extracted the preceding description block...

PT-2023-2624

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Win32k component of Windows operating systems. This vulnerability is associated with errors in processing objects in...

KLA49154 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, gain privileges, obtain sensitive information, cause denial of service. Below is a complete list of vulnerabilities: 1. A remote cod...

Oracle Linux 9 : samba (ELSA-2023-2127)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2127 advisory. - related: rhbz2154372 - Add additional patches for CVE-2022-38023 - Fix CVE-2022-38023 Tenable has extracted the preceding description block directly from the...

Oracle WebLogic Server vulnerability added to CISA list as “known to be exploited”

On May 1, 2023 the Cybersecurity and Infrastructure Security Agency CISA added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This means that Federal Civilian Executive Branch FCEB agencies are obliged to remediate the...

Debian dla-3414 : avahi-autoipd - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3414 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3414-1 [email protected] https://www.debian.org/lts/security/...

RHEL 8 : libwebp (RHSA-2023:2076)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2076 advisory. The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photograph...

Amazon Linux 2 : nasm (ALAS-2023-2029)

The version of nasm installed on the remote host is prior to 2.15.03-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2029 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has...

CVE-2023-28092

A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access inside the server chassis...

A week in security (April 24 -30)

Last week on Malwarebytes Labs: LockBit and Cl0p ransomware gangs actively exploiting Papercut vulnerabilities Update now: Critical flaw in VMWare Fusion and VMWare Workstation Magecart threat actor rolls out convincing modal forms Fileless attacks: How attackers evade traditional AV and how to...

CISA Warns of Critical Flaws in Illumina's DNA Sequencing Instruments

The U.S. Cybersecurity and Infrastructure Security Agency CISA has released an Industrial Control Systems ICS medical advisory warning of a critical flaw impacting Illumina medical devices. The issues impact the Universal Copy Service UCS software in the Illumina MiSeqDx, NextSeq 550Dx, iScan, iS...

LockBit and Cl0p ransomware gangs actively exploiting Papercut vulnerabilities

A few days ago we wrote about two vulnerabilities found in PaperCut application servers. As we noted, exploitation was fairly simple so there was some urgency to install the patches. My esteemed colleague Chris Boyd literally wrote: "Arbitrary code can be deployed, or even ransomware if thats par...

Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware

Microsoft has confirmed that the active exploitation of PaperCut servers is linked to attacks that are designed to deliver Cl0p and LockBit ransomware families. The tech giant's threat intelligence team is attributing a subset of the intrusions to a financially motivated actor it tracks under the...

MAL-2023-16 Malicious code in 3a-look (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9a61325b2b1ed4acb6eb7991d48682f56a090fbf84663645a94f4d8415e5b00b Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

New Tomiris APT Group Targets Governments

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Tomiris is a Russian-speaking advanced persistent threat APT group that has been active since at least 2021 and is known for its use of sophisticated tactics and tools, including zero-day exploits and...

Update your PaperCut application servers now: Exploits in the wild

PaperCut, maker of print management solutions, has urged product users to update as soon as possible. A security vulnerability which exploits unpatched servers has been seen in the wild, with serious ramifications for any organisation impacted. Two specific vulnerabilities are at the heart of thi...