Threat Round up for November 11 to 18

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Nov. 11 and Nov. 18. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Emotet coming in hot

Emotet is a ubiquitous and well-known banking trojan that has evolved over the years to become a very successful modular botnet capable of dropping a variety of other threats. Even after a global takedown campaign in early 2021 disrupted the botnet, it reemerged later that year, rebuilding its...

Amadey Bot Spotted Deploying LockBit 3.0 Ransomware on Hacked Machines

The Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems, researchers have warned. "Amadey bot, the malware that is used to install LockBit, is being distributed through two methods: one using a malicious Word document file, and the other using an executable that...

unbound: integer overflow in the regional allocator via the ALIGN_UP macro

A flaw was found in unbound. An integer overflow in the regional allocator via the ALIGNUP macro may lead to a buffer overflow if the size can be controlled by an attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability...

kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB

A vulnerability was found in the Linux kernel's SCSI driver, in sgcopybuffer function, where an incorrect type in the mint macro can lead to a stack out-of-bounds condition. This occurs due to sign extension of larger values, which may result in memory corruption or DoS...

CVE-2022-44724

The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability...

CVE-2022-44724: Improper Neutralization of Input During Web Page Generation

The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability...

APT10: Tracking down LODEINFO 2022, part I

Kaspersky has been tracking activities involving the LODEINFO malware family since 2019, looking for new modifications and thoroughly investigating any attacks utilizing those new variants. LODEINFO is sophisticated fileless malware first named in a blogpost from JPCERT/CC in February 2020. The...

CVE-2022-2474

CVE-2022-2474 affects Haas Controller, version 100.20.000.1110, where the Ethernet Q Commands service lacks authentication. Any user on the same network segment (including remote connections) can access the service and write unauthorized macros to registers, enabling high-impact outcomes per ICS ...

PT-2022-16842 · Haas · Haas Controller

Name of the Vulnerable Software and Affected Versions: Haas Controller version 100.20.000.1110 Description: The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controlle...

Ubuntu: Security Advisory (USN-5694-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5694-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were tricked into opening a specially crafted document, a remote attacker could use this issue to execute arbitrary scripts. CVE-2022-3140 Thomas Florian discovered that LibreOffice incorrectly...

USN-5694-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were tricked into opening a specially crafted document, a remote attacker could use this issue to execute arbitrary scripts. CVE-2022-3140 Thomas Florian discovered that LibreOffice incorrectly...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2022:3650-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3650-1 advisory. - An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was...

SUSE-SU-2022:3602-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 7.3.6.2 jscSLE-23448: - CVE-2022-3140: Fixed macro URL arbitrary script execution bsc1203209. - CVE-2022-26305: Fixed execution of untrusted Macros due to improper certificate validation bsc1201868. - CVE-2022-26307: Fixed...