October 11, 2022—KB5018454 (Monthly Rollup)

None None...

DeftTorero: tactics, techniques and procedures of intrusions revealed

Earlier this year, we started hunting for possible new DeftTorero aka Lebanese Cedar, Volatile Cedar artifacts. This threat actor is believed to originate from the Middle East and was publicly disclosed to the cybersecurity community as early as 2015. Notably, no other intelligence was shared unt...

CISA and NSA Publish Joint Cybersecurity Advisory on Control System Defense

CISA and the National Security Agency NSA have published a joint cybersecurity advisory about control system defense for operational technology OT and industrial control systems ICSs. Control System Defense: Know the Opponent is intended to provide critical infrastructure owners and operators wit...

Iranian State Actors Conduct Cyber Operations Against the Government of Albania

CISA and the Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA, Iranian State Actors Conduct Cyber Operations Against the Government of Albania, detailing malicious cyber operations that included ransomware and disk wiper, rendering websites and services...

#StopRansomware: Vice Society

CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC have released a joint Cybersecurity Advisory CSA, StopRansomware: Vice Society, to disseminate tactics, techniques, and procedures TTPs and indicators of compromise IOCs associated...

CVE-2022-36120

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the getChartData administrative...

Blue Prism Enterprise 安全漏洞

Blue Prism Enterprise is an intelligent robotic process automation RPA software from Blue Prism UK. A security vulnerability exists in Blue Prism Enterprise versions 6.0 through 7.01, which arises from a misconfigured environment that exposes the Blue Prism application server and allows an...

PT-2022-23208 · Blue Prism · Blue Prism Enterprise

Name of the Vulnerable Software and Affected Versions: Blue Prism Enterprise versions 6.0 through 7.01 Description: The issue allows an authenticated user to reverse engineer the software and circumvent access controls for the getChartData administrative function in a misconfigured environment th...

Remote code execution

The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution...

CVE-2022-23764 TERUTEN WebCube update remote code execution vulnerability

The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution...

Google Android 资源管理错误漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to gain elevated...

Google Pixel 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to gain elevated...

Google Pixel 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to cause an elevatio...

Vulnerability of the Server component: The stored procedures of the Oracle MySQL Server database management system, which allow attackers to cause service interruptions.

The vulnerability of the Server component – the stored procedure in the Oracle MySQL Server database management system – is related to resource release errors. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL protocol...

Vulnerability of the Server component: The stored procedures of the MySQL Server database management system, which allow attackers to cause service interruptions.

The vulnerability of the MySQL Server component, specifically the stored procedures, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

#StopRansomware: MedusaLocker

CISA, the Federal Bureau of Investigation FBI, the Department of the Treasury Treasury, and the Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory CSA, StopRansomware: MedusaLocker, to provide information on MedusaLocker ransomware. MedusaLocker actors target...

DEBIAN-CVE-2022-2085

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs defined for the device that uses it as a prototype that depends upon the number of bits per...

CVE-2022-25152: Improperly Implemented Security Check for Standard

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

CISA, the National Security Agency NSA, and the Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA to provide information on ways in which People’s Republic of China PRC state-sponsored cyber actors continue to exploit publicly known vulnerabilities in order to...

Karakurt Data Extortion Group

CISA, the Federal Bureau of Investigation FBI, the Department of Treasury, and the Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory CSA to provide information on the Karakurt data extortion group. Karakurt actors steal data and threaten to auction it off or...