GSD-2022-1005937 s390: fix double free of GS and RI CBs on fork() failure

s390: fix double free of GS and RI CBs on fork failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.212 by commit...

Threat Roundup for September 9 to September 16

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 9 and Sept. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristic...

CVE-2022-20923

creationtimestamp| type| source ---|---|--- 2022-09-08 12:18:30+00:00| seen| https://t.me/itsecnews/1387 2022-09-08 15:20:10+00:00| seen| https://t.me/truesecator/3392 2022-09-08 16:15:09+00:00| seen| https://t.me/cibsecurity/49454 2022-09-09 08:20:14+00:00| seen| https://t.me/codebysec/6548...

The vulnerability of the TMW IEC 61850 Software Library and the TMW IEC 60870-6 (ICCP/TASE.2) Software Library lies in their inability to access uninitialized indicators, allowing attackers to cause service failures.

The vulnerability of the TMW IEC 61850 Software Library and the TMW IEC 60870-6 ICCP/TASE.2 Software Library relates to the access to an uninitialized indicator. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

#StopRansomware: Vice Society

CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC have released a joint Cybersecurity Advisory CSA, StopRansomware: Vice Society, to disseminate tactics, techniques, and procedures TTPs and indicators of compromise IOCs associated...

OpenTIP, command line edition

For more than a year, we have been providing free intelligence services via the OpenTIP portal. Using the web interface, anyone can upload and scan files with our antivirus engine, get a basic sandbox report, look up various network indicators IP addresses, hosts, URLs. Later on, we presented an...

CVE-2022-35801

creationtimestamp| type| source ---|---|--- 2022-08-10 00:25:03+00:00| seen| https://t.me/cibsecurity/47801 2022-08-10 00:31:03+00:00| seen| https://t.me/cibsecurity/47820...

Can your EDR handle a ransomware attack? 6-point checklist for an anti-ransomware EDR

Most cybersecurity experts agree that having Endpoint Detection and Response software is essential to fighting ransomware today--but not every EDR is equal. Businesses, especially small-to-medium sized ones with limited budget or IT resources, need to make sure that their EDR is cost-effective,...

Patlite 缓冲区错误漏洞

Patlite is a network monitoring indicator from Patlite Japan. It is used to detect network anomalies with instant notification by light, sound and email. A buffer error vulnerability exists in Patlite versions 1.45 and earlier, which stems from the fact that it allows an attacker to implement a...

WordPress Kaswara Modern WPBakery Page Builder 3.0.1 File Upload Vulnerability

WordPress Kaswara Modern WPBakery Page Builder plugin versions 3.0.1 and below suffer from an arbitrary file upload vulnerability. Description: Arbitrary File Upload/Deletion and Other Affected Plugin: Kaswara Modern WPBakery Page Builder Addons Plugin Slug: kaswara Affected Versions: = 3.0.1 CVE...

North Korean APT targets US healthcare sector with Maui ransomware

State-sponsored North Korean threat actors have been targeting the US Healthcare and Public Health HPH sector for the past year using the Maui ransomware, according to a joint cybersecurity advisory CSA from the FBI, Cybersecurity and Infrastructure Security Agency CISA, and the Department of the...

Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems

CISA and the United States Coast Guard Cyber Command CGCYBER have released a joint Cybersecurity Advisory CSA to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat APT actors, have continued to exploit CVE-2021-44228 Log4Shell in VMware Horizon®...

CVE-2022-30128

creationtimestamp| type| source ---|---|--- 2022-06-02 00:24:57+00:00| seen| https://t.me/cibsecurity/43627 2022-06-02 01:23:36+00:00| seen| https://t.me/cibsecurity/43625...

OilRig is back with another Phishing Email attack, delivering the Saitama Backdoor

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here An Iranian cyber espionage gang known as OilRig has began delivering malicious email to a Jordanian government employee at the foreign ministry. The email includes a malicious Excel sheet that installs the Saitama backdoor...

CISA Urges Organizations to Patch Actively Exploited F5 BIG-IP Vulnerability

.jpg The U.S. Cybersecurity and Infrastructure Security Agency CISA has added the recently disclosed F5 BIG-IP flaw to its Known Exploited Vulnerabilities Catalog following reports of active abuse in the wild. The flaw, assigned the identifier CVE-2022-1388 CVSS score: 9.8, concerns a critical bu...

CISA and FBI Update Advisory on Destructive Malware Targeting Organizations in Ukraine

CISA and the Federal Bureau of Investigation FBI have updated joint Cybersecurity Advisory AA22-057A: Destructive Malware Targeting Organizations in Ukraine, originally released February 26, 2022. The advisory has been updated to include additional indicators of compromise for WhisperGate and...

Newly patched VMware vulnerability exploited by Iranian espionage group, Rocket Kitten

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here An Iranian cyber espionage gang known as Rocket Kitten has began delivering the Core Impact penetration testing tool on susceptible computers by exploiting a newly fixed severe vulnerability in VMware Workspace ONE...

Deep Panda deploys new rootkit “Fire Chili” by exploiting Log4shell in VMware horizon

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Deep Panda, a Chinese APT group, took advantage of the well-known Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor, rootkit, and steal sensitive data. This threat actor is primarily targeting firms in the...

FBI and FinCEN Release Advisory on AvosLocker Ransomware

The Federal Bureau of Investigation FBI and the Department of the Treasury’s Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory identifying indicators of compromise associated with AvosLocker ransomware. AvosLocker is a ransomware-as-a-service affiliate-based...

Russian State-Sponsored Cyber Actors Access Network Misconfigured with Default MFA Protocols

CISA and the Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory that details how Russian state-sponsored cyber actors accessed a network with misconfigured default multifactor authentication MFA protocols. The actors then exploited a critical Windows Print Spooler...