Daily

daily@lists.cert.at

3157 discussions

Tageszusammenfassung - 02.12.2022
by Daily end-of-shift report 02 Dec '22

02 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-12-2022 18:00 − Freitag 02-12-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Unpatched Redis servers targeted in new Redigo malware attacks ∗∗∗ --------------------------------------------- A new Go-based malware threat that researchers call Redigo has been targeting Redis servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow command execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/unpatched-redis-servers-targ… ∗∗∗ Samsung, Mediatek, LG: Android-Malware mit OEM-Zertifikaten signiert ∗∗∗ --------------------------------------------- Google hat Malware gefunden, die mit den Zertifikaten von Android-Herstellern signiert sind. Das kann für Systemberechtigungen genutzt werden. --------------------------------------------- https://www.golem.de/news/samsung-mediatek-lg-android-malware-mit-oem-zerti… ∗∗∗ obama224 distribution Qakbot tries .vhd (virtual hard disk) images, (Fri, Dec 2nd) ∗∗∗ --------------------------------------------- Qakbot (also called Qbot) is a long-running malware family that has seen wide-spread distribution through malicious spam (malspam) in recent years. During an infection, Qakbot performs different functions as an information stealer, backdoor, and malware downloader. --------------------------------------------- https://isc.sans.edu/diary/rss/29294 ∗∗∗ Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection ∗∗∗ --------------------------------------------- New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "unexpected behavior" in the npm command line interface (CLI) tool. --------------------------------------------- https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html ∗∗∗ Flaws in GX Works3 Threaten Mitsubishi Electric Safety PLC Security ∗∗∗ --------------------------------------------- In this blog, we uncover three additional vulnerabilities that affect Mitsubishi Electric GX Works3, tracked under CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833 (Mitsubishi Electric advisory 2022-015, CISA advisory ICSA-22-333-05), and that, in the worst-case scenario, may lead to the compromise of safety PLCs with the only requirement being the possession of associated GX Works3 project files. --------------------------------------------- https://www.nozominetworks.com/blog/flaws-in-gx-works3-threaten-mitsubishi-… ∗∗∗ Jetzt patchen! Angreifer attackieren Firewalls und Proxies von Fortinet ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen vor Attacken auf Firmen. Der Grund ist eine kritische Lücke in Fortinet-Produkten. --------------------------------------------- https://heise.de/-7364286 ∗∗∗ Wordpress: Attackiert schon während der Installation ∗∗∗ --------------------------------------------- Noch bevor das System live geht, haben Angreifer es oft unbemerkt mit Hintertüren versehen. Die stehen nämlich schon nach wenigen Minuten auf der Matte. --------------------------------------------- https://heise.de/-7364588 ∗∗∗ IBM Cloud Vulnerability Exposed Users to Supply Chain Attacks ∗∗∗ --------------------------------------------- IBM recently patched a vulnerability in IBM Cloud Databases for PostgreSQL that could have exposed users to supply chain attacks. The vulnerability has been named Hell’s Keychain by cloud security firm Wiz, whose researchers discovered the issue. It has been described by the company as a “first-of-its-kind supply-chain attack vector impacting a cloud provider’s infrastructure”. --------------------------------------------- https://www.securityweek.com/ibm-cloud-vulnerability-exposed-users-supply-c… ∗∗∗ Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges ∗∗∗ --------------------------------------------- Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system. --------------------------------------------- https://www.securityweek.com/three-innocuous-linux-vulnerabilities-chained-… ∗∗∗ Blowing Cobalt Strike Out of the Water With Memory Analysis ∗∗∗ --------------------------------------------- Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic. --------------------------------------------- https://unit42.paloaltonetworks.com/cobalt-strike-memory-analysis/ ∗∗∗ Protecting major events: an incident response blueprint ∗∗∗ --------------------------------------------- Cisco Talos Incident Response (Talos IR) is sharing a white paper on the steps organizations should follow to secure any major event. These ten focus areas should help guide any organizing committee or participating businesses in preparation for securing such events. --------------------------------------------- https://blog.talosintelligence.com/protecting-major-events-an-incident-resp… ∗∗∗ Industry 4.0: CNC Machine Security Risks Part 2 ∗∗∗ --------------------------------------------- This three-part blog series explores the risks associated with CNC machines --------------------------------------------- https://www.trendmicro.com/en_us/research/22/l/cnc-machine-security-risks-p… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-12-01 ∗∗∗ --------------------------------------------- IBM Watson, IBM App Connect, Rational Functional Tester, IBM Security Guardium, IBM Cloud Object Storage Systems, IBM API Connect. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (snapd), Fedora (firefox, libetpan, ntfs-3g, samba, thunderbird, and xen), SUSE (busybox, emacs, and virt-v2v), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-gcp, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws-hwe, linux-gcp, linux-hwe, linux-oracle, and tiff). --------------------------------------------- https://lwn.net/Articles/916658/ ∗∗∗ BD BodyGuard Pumps ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-22-335-01 ∗∗∗ Mitsubishi Electric MELSEC iQ-R Series ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-335-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.12.2022
by Daily end-of-shift report 01 Dec '22

01 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-11-2022 18:00 − Donnerstag 01-12-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New Windows malware scans victims’ mobile phones for data to steal ∗∗∗ --------------------------------------------- Security researchers found a previously unknown backdoor they call Dophin thats been used by North Korean hackers in highly targeted operations for more than a year to steal files and send them to Google Drive storage. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-windows-malware-scans-vi… ∗∗∗ New DuckLogs malware service claims having thousands of ‘customers’ ∗∗∗ --------------------------------------------- A new malware-as-a-service (MaaS) operation named DuckLogs has emerged, giving low-skilled attackers easy access to multiple modules to steal information, log key strokes, access clipboard data, and remote access to the compromised host. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-ducklogs-malware-service… ∗∗∗ Making unphishable 2FA phishable ∗∗∗ --------------------------------------------- One of the huge benefits of WebAuthn is that it makes traditional phishing attacks impossible. But what if there was a mechanism for an attacker to direct a user to a legitimate login page, resulting in a happy WebAuthn flow, and obtain valid credentials for that user anyway? --------------------------------------------- https://mjg59.dreamwidth.org/62175.html ∗∗∗ Whats the deal with these router vulnerabilities?, (Thu, Dec 1st) ∗∗∗ --------------------------------------------- Earlier today, I was browser recently made public vulnerabilities for tomorrow's version of our @Risk newsletter. What stuck out was a set of about twenty vulnerabilities in Netgear and DLink routers. --------------------------------------------- https://isc.sans.edu/diary/rss/29288 ∗∗∗ Sirius XM flaw unlocks so-called smart cars thanks to code flaw ∗∗∗ --------------------------------------------- Telematics program doesn't just give you music, but a big security flaw Sirius XMs Connected Vehicle Services has fixed an authorization flaw that would have allowed an attacker to remotely unlock doors and start engines on connected cars knowing only the vehicle identification number (VIN). --------------------------------------------- https://www.theregister.com/2022/11/30/siriusxm_connected_cars_hacking/ ∗∗∗ l+f: Sicherheitsforscher legen aus Versehen gesamtes Botnet KmsdBot lahm ∗∗∗ --------------------------------------------- Wie ein Typo kriminellen Machenschaften das Handwerk legt. --------------------------------------------- https://heise.de/-7363007 ∗∗∗ Vorsicht, wenn Sie ein SMS von Amazon erhalten ∗∗∗ --------------------------------------------- Kriminelle geben sich als Amazon aus und versenden gefälschte Benachrichtigungen. Im SMS steht, dass Ihr Amazon-Konto vorübergehend gesperrt wurde und Sie Informationen aktualisieren müssen. Dafür sollten Sie auf einen Link klicken. Achtung: Der Link führt zu einer gefälschten Login-Seite. Kriminelle stehlen damit Ihre Benutzer- und Kreditkartendaten! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-wenn-sie-ein-sms-von-amazon… ∗∗∗ LastPass-Kundendaten nach Hack eines Cloud-Speicherdiensts abgezogen (Nov. 2022) ∗∗∗ --------------------------------------------- Der Dienst LastPass informierte vor einigen Stunden seine Kunden, dass kürzlich "ungewöhnliche Aktivitäten" bei einem Cloud-Speicherdienst eines Drittanbieters entdeckt wurden. --------------------------------------------- https://www.borncity.com/blog/2022/12/01/lastpass-kundendaten-nach-hack-ein… ∗∗∗ Vulnerability Spotlight: Lansweeper directory traversal and cross-site scripting vulnerabilities ∗∗∗ --------------------------------------------- Cisco Talos recently discovered several directory traversal and cross-site scripting vulnerabilities in Lansweeper. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-spotlight-lansweeper-direc… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical RCE bugs in Android remote keyboard apps with 2M installs ∗∗∗ --------------------------------------------- Three Android applications that allow users to use devices as remote keyboards for their computers have critical vulnerabilities that could expose key presses and enable remote code execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-rce-bugs-in-android… ∗∗∗ IBM Security Bulletins 2022-11-30 ∗∗∗ --------------------------------------------- IBM API Connect, IBM MQ Operator and Queue manager container images, IBM Security Guardium, IBM Sterling Control Center, IBM Watson Discovery for IBM Cloud Pak for Data, IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (device-mapper-multipath, firefox, hsqldb, krb5, thunderbird, and xorg-x11-server), Debian (libraw), Fedora (freerdp and grub2), SUSE (bcel, emacs, glib2, glibc, grub2, nodejs10, and tomcat), and Ubuntu (linux-azure-fde and snapd). --------------------------------------------- https://lwn.net/Articles/916443/ ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-062 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-062 ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-061 ∗∗∗ Social Base - Moderately critical - Access bypass - SA-CONTRIB-2022-060 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-060 ∗∗∗ Horner Automation Remote Compact Controller ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-335-02 ∗∗∗ Replay Angriffe & Darstellung beliebiger Inhalte in Zhuhai Suny Technology ESL Tag / ETAG-TECH protocol (electronic shelf labels) ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/replay-attacks-displa… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.11.2022
by Daily end-of-shift report 30 Nov '22

30 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-11-2022 18:00 − Mittwoch 30-11-2022 18:00 Handler: Robert Waldner Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ How Stuff Gets eXposed ∗∗∗ --------------------------------------------- Intel's Software Guard Extension (SGX) promises an isolated execution environment, protected from all software running on the machine. In the past few years, however, SGX has come under heavy fire, threatened by numerous side channel attacks. --------------------------------------------- https://sgx.fail/ ∗∗∗ Looting Microsoft Configuration Manager ∗∗∗ --------------------------------------------- Microsoft Endpoint Configuration Manager (CM), also known as System Center Configuration Manager (SCCM), is widely deployed by companies to manage their Windows environments. It enables simple enrollment of servers and workstations, distributing software and generic management of the Windows systems in the environment. --------------------------------------------- https://labs.withsecure.com/publications/looting-microsoft-configuration-ma… ∗∗∗ Was tun, wenn Sie in einem Fake-Shop bestellt haben? ∗∗∗ --------------------------------------------- Sie haben im Internet eingekauft. Das bestellte Produkt kommt aber nicht an, E-Mails an den vermeintlichen Shop bleiben unbeantwortet. Kommt Ihnen das bekannt vor, haben Sie wahrscheinlich in einem Fake-Shop eingekauft. Wir zeigen Ihnen, was Sie tun können, wenn Sie in die Shopping-Falle getappt sind. --------------------------------------------- https://www.watchlist-internet.at/news/was-tun-wenn-sie-in-einem-fake-shop-… ∗∗∗ Industry 4.0: CNC Machine Security Risks Part 1 ∗∗∗ --------------------------------------------- This three-part blog series explores the risks associated with CNC machines. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/k/cnc-machine-security-risks-p… ===================== = Vulnerabilities = ===================== ∗∗∗ NVIDIA releases GPU driver update to fix 29 security flaws ∗∗∗ --------------------------------------------- NVIDIA has released a security update for its GPU display driver for Windows, containing a fix for a high-severity flaw that threat actors can exploit to perform, among other things, code execution and privilege escalation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/nvidia-releases-gpu-driver-u… ∗∗∗ CISA Releases Seven Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-22-333-01 Mitsubishi Electric GOT2000 * ICSA-22-333-02 Hitachi Energys IED Connectivity Packages and PCM600 Products * ICSA-22-333-03 Hitachi Energys MicroSCADA ProX SYS600 Products * ICSA-22-333-04 Moxa UC Series * ICSA-22-333-05 Mitsubishi Electric FA Engineering Software * ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update E) * ICSA-19-346-02 Omron PLC CJ --------------------------------------------- https://www.cisa.gov/uscert/ncas/current-activity/2022/11/29/cisa-releases-… ∗∗∗ Kritische Sicherheitslücke in VLC Media Player ∗∗∗ --------------------------------------------- Ein Update steht für den VLC Media Player bereit, mit dem die Entwickler unter anderem eine kritische Sicherheitslücke schließen. --------------------------------------------- https://heise.de/-7362049 ∗∗∗ Webbrowser Chrome 108 dichtet 28 Sicherheitslücken ab ∗∗∗ --------------------------------------------- Das Update auf den Webbrowser Chrome 108 liefert im Wesentlichen Fehlerkorrekturen, die 28 Schwachstellen schließen. --------------------------------------------- https://heise.de/-7361154 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (krb5), Fedora (galera, mariadb, and mingw-python3), Red Hat (389-ds:1.4, kernel, kernel-rt, kpatch-patch, krb5, and usbguard), Scientific Linux (krb5), Slackware (kernel), SUSE (binutils, dbus-1, exiv2, freerdp, git, java-1_8_0-ibm, kernel, libarchive, libdb-4_8, libmspack, nginx, opencc, python, python3, rxvt-unicode, sudo, supportutils, systemd, vim, and webkit2gtk3), and Ubuntu (bind9, gnutls28, libsamplerate, linux-gcp-5.4, perl, pixman, shadow, [...] --------------------------------------------- https://lwn.net/Articles/916346/ ∗∗∗ Delta Electronics Patches Serious Flaws in Industrial Networking Devices ∗∗∗ --------------------------------------------- Taiwan-based Delta Electronics has patched potentially serious vulnerabilities in two of its industrial networking products. The flaws were identified by researchers at CyberDanube, a new industrial cybersecurity company based in Austria, in Delta’s DX-2100-L1-CN 3G cloud router and the DVW-W02W2-E2 industrial wireless access point. --------------------------------------------- https://www.securityweek.com/delta-electronics-patches-serious-flaws-indust… ∗∗∗ Developers Warned of Critical Remote Code Execution Flaw in Quarkus Java Framework ∗∗∗ --------------------------------------------- Developers have been warned that the popular Quarkus framework is affected by a critical vulnerability that could lead to remote code execution. --------------------------------------------- https://www.securityweek.com/developers-warned-critical-remote-code-executi… ∗∗∗ Anker Eufy Door Bell Sicherheitskameras mit Schwachstellen, Daten werden in die Cloud übertragen, Homebase 2 hat auch Schwachstellen ∗∗∗ --------------------------------------------- Anker Eufy Door Bell-Sicherheitskameras werden auch in Deutschland verkauft. Ein Sicherheitsforscher hat nun verschiedene Sicherheitslücken in der Firmware der Eufy-Kameras gefunden. --------------------------------------------- https://www.borncity.com/blog/2022/11/30/anker-eufy-door-bell-sicherheitska… ∗∗∗ Drop What Youre Doing and Update iOS, Android, and Windows ∗∗∗ --------------------------------------------- https://www.wired.com/story/ios-android-windows-vulnerability-patches-novem… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in a Huawei Childrens Watch ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iaviahcw-… ∗∗∗ Security Bulletin: A Kafka vulnerability affects IBM Operations Analytics Predictive Insights (CVE-2022-34917 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-kafka-vulnerability-aff… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.4ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 – 2022.4.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty profile affects IBM Operations Analytics Predictive Insights(CVE-2022-22393 CVE-2022-22476 CVE-2022-22475) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-we… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Netty libraries affect IBM Operations Analytics Predictive Insights (CVE-2021-43797 CVE-2022-24823) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM Operations Analytics Predictive Insights ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to remote authenticated attacker to execute arbitrary code on the system due to PostgreSQL (CVE-2022-2625) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Zahlreiche kritische Schwachstellen in Planet Enterprises Ltd - Planet eStream ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/multiple-critical-vul… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.11.2022
by Daily end-of-shift report 29 Nov '22

29 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Montag 28-11-2022 18:00 − Dienstag 29-11-2022 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Malicious Android app found powering account creation service ∗∗∗ --------------------------------------------- A fake Android SMS application, with 100,000 downloads on the Google Play store, has been discovered to secretly act as an SMS relay for an account creation service for sites like Microsoft, Google, Instagram, Telegram, and Facebook [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-android-app-found-… ∗∗∗ Cyber-Threat Group Targets Critical RCE Vulnerability in Bleed You Campaign ∗∗∗ --------------------------------------------- More than 1,000 systems are exposed to a campaign hunting weak Windows servers and more. --------------------------------------------- https://www.darkreading.com/threat-intelligence/cyber-threat-weak-windows-s… ∗∗∗ Subdomain Enumeration with DNSSEC ∗∗∗ --------------------------------------------- In my previous blog post I described how subdomain enumeration and subdomain bruteforce in particular could be enhanced by taking DNS status code into account, rather than relying on the existence of A or AAAA records only. This follow-up post describes what techniques exist to enumerate subdomains in a DNSSEC-enabled zone and what countermeasures exist to prevent it. --------------------------------------------- https://www.securesystems.de/blog/subdomain-enumeration-with-DNSSEC/ ∗∗∗ Angreifer könnten Secure Boot auf bestimmten Acer-Notebooks deaktivieren ∗∗∗ --------------------------------------------- Acers Entwickler haben eine Sicherheitslücke geschlossen. Unter bestimmten Umständen könnten Angreifer UEFI-Einstellungen manipulieren. Updates sind in Sicht. --------------------------------------------- https://heise.de/-7359874 ∗∗∗ #InvisibleChallenge: Malware sucht Opfer mit TikTok-Challenge ∗∗∗ --------------------------------------------- Cyberkriminelle missbrauchen eine Nackt-Tanz-Challenge auf TikTok, um Opfer zum Installieren ihrer Malware zu bewegen. Diese solle einen Filter entfernen. --------------------------------------------- https://heise.de/-7360626 ∗∗∗ Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587) ∗∗∗ --------------------------------------------- A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. --------------------------------------------- https://www.helpnetsecurity.com/2022/11/29/cve-2021-35587-exploited/ ∗∗∗ Project Zero Flags Patch Gap Problems on Android ∗∗∗ --------------------------------------------- Vulnerability researchers at Google Project Zero are calling attention to the ongoing “patch-gap” problem in the Android ecosystem, warning that downstream vendors continue to be tardy at delivering security fixes to Android-powered devices. --------------------------------------------- https://www.securityweek.com/project-zero-flags-patch-gap-problems-android ∗∗∗ Booking.com: Vorsicht vor gefälschten Angeboten ∗∗∗ --------------------------------------------- Sie haben auf Booking.com eine verlockende Unterkunft gefunden? Der Buchungsprozess verläuft aber nicht wie gewohnt? Vorsicht! Möglicherweise sind Sie auf ein betrügerisches Angebot gestoßen. Wenn Unterkunftgeber:innen Sie von Booking.com auf eine andere Website verweisen, handelt es sich um eine Betrugsmasche. Wir erklären Ihnen, worauf Sie achten sollten! --------------------------------------------- https://www.watchlist-internet.at/news/bookingcom-vorsicht-vor-gefaelschten… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-11-28 ∗∗∗ --------------------------------------------- Digital Certificate Manager for IBM i, IBM App Connect Enterprise Certified Container IntegrationServer operands, IBM Operations Analytics Predictive Insights, IBM Planning Analytics Workspace, IBM Sterling Connect:Direct for UNIX, IBM UrbanCode Deploy (UCD), IBM UrbanCode Deploy (UCD) Agents on zOS, IBM WebSphere Application Server Liberty, ISC BIND on IBM i --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ VMSA-2022-0029 ∗∗∗ --------------------------------------------- CVSSv3 Range: 3.3 CVE(s): CVE-2022-31693 Synopsis: VMware Tools for Windows update addresses a denial-of-service vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0029.html ∗∗∗ K11742512: BIND vulnerability CVE-2022-2795 ∗∗∗ --------------------------------------------- By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. --------------------------------------------- https://support.f5.com/csp/article/K11742512 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (frr, gerbv, mujs, and twisted), Fedora (nodejs and python-virtualbmc), Oracle (dotnet7.0, kernel, kernel-container, krb5, varnish, and varnish:6), SUSE (busybox, python3, tiff, and tomcat), and Ubuntu (harfbuzz). --------------------------------------------- https://lwn.net/Articles/916189/ ∗∗∗ Edge 107.0.1418.62 ∗∗∗ --------------------------------------------- Kurzer Nachtrag: Microsoft hat zum 28. November 2022 den Edge-Browser im Stable Stable Channel auf die Version 107.0.1418.52 aktualisiert. Ist ein Sicherheits-Update, welches gemäß den Release Notes die vom Chromium-Team berichtete Schwachstelle CVE-2022-4135 schließt. --------------------------------------------- https://www.borncity.com/blog/2022/11/29/edge-107-0-1418-62/ ∗∗∗ Festo: Incomplete documentation of remote accessible functions and protocols in Festo products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-041/ ∗∗∗ Festo: Multiple Festo products contain an unsafe default Codesys configuration ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-037/ ∗∗∗ Mitsubishi Electric GOT2000 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-333-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.11.2022
by Daily end-of-shift report 28 Nov '22

28 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 25-11-2022 18:00 − Montag 28-11-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Win32.Ransom.Conti / Crypto Logic Flaw ∗∗∗ --------------------------------------------- Conti ransomware FAILS to encrypt non PE files that have a ".exe" in the filename. --------------------------------------------- https://cxsecurity.com/issue/WLB-2022110044 ∗∗∗ Bring Your Own Key — A Placebo? ∗∗∗ --------------------------------------------- BYOK was envisioned to reduce the risk of using a cloud service provider processing sensitive data, yet there are several deficiencies. --------------------------------------------- https://www.darkreading.com/cloud/bring-your-own-key-a-placebo- ∗∗∗ All You Need to Know About Emotet in 2022 ∗∗∗ --------------------------------------------- For 6 months, the infamous Emotet botnet has shown almost no activity, and now its distributing malicious spam. Lets dive into details and discuss all you need to know about the notorious malware to combat it. --------------------------------------------- https://thehackernews.com/2022/11/all-you-need-to-know-about-emotet-in.html ∗∗∗ Hacking Smartwatches for Spear Phishing ∗∗∗ --------------------------------------------- In this article we explain how to hack into a SmartWatch and show a custom text message. --------------------------------------------- https://cybervelia.com/?p=1380 ∗∗∗ Exploiting an N-day vBulletin PHP Object Injection Vulnerability ∗∗∗ --------------------------------------------- vBulletin is one of the most popular proprietary forum solutions over the Internet. It is used by some major websites, and according to the BuildWith website, vBulletin currently ranks at the second place on the Forum Software Usage Distribution in the Top 1 Million Sites, with over 2.000 websites using it among the “top 1 million”. --------------------------------------------- https://karmainsecurity.com/exploiting-an-nday-vbulletin-php-object-injecti… ∗∗∗ Poking a mobile hotspot ∗∗∗ --------------------------------------------- Ive been playing with an Orbic Speed, a relatively outdated device that only speaks LTE Cat 4, but the towers I can see from here are, uh, not well provisioned so throughput really isnt a concern (and refurbs are $18, so). As usual Im pretty terrible at just buying devices and using them for their intended purpose, and in this case it has the irritating behaviour that if theres a power cut and the battery runs out it doesnt boot again when power returns, so heres what Ive learned so far. --------------------------------------------- https://mjg59.dreamwidth.org/61725.html ∗∗∗ Vorsicht vor gefälschtem FinanzOnline-E-Mail ∗∗∗ --------------------------------------------- „Sie erhalten einen Betrag“ lautet der Betreff eines betrügerischen E-Mail, das angeblich von FinanzOnline kommt. Sie werden informiert, dass Sie eine Rückerstattung von 578,99 Euro erhalten. Um das Geld zu bekommen, müssen Sie auf den Link im E-Mail klicken. Vorsicht: Dieser führt auf eine gefälschte FinanzOnline-Seite. Kriminelle stehlen Ihre Daten. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschtem-finanzonli… ∗∗∗ Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware ∗∗∗ --------------------------------------------- The intrusion began when a user double clicked a LNK file, which then executed encoded Powershell commands to download an Emotet DLL onto the computer. Once executed, Emotet setup a Registry Run Key to maintain persistence on the beachhead host. --------------------------------------------- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to… ∗∗∗ LockBit Ransomware Being Mass-distributed With Similar Filenames ∗∗∗ --------------------------------------------- The ASEC analysis team had written about LockBit ransomware being distributed through emails over three blog posts. Through consistent monitoring, we hereby let you know that LockBit 2.0 and LockBit 3.0 are being distributed again with only a change to their filenames. --------------------------------------------- https://asec.ahnlab.com/en/42890/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, commons-configuration2, graphicsmagick, heimdal, inetutils, ini4j, jackson-databind, and varnish), Fedora (drupal7-i18n, grub2, kubernetes, and python-slixmpp), Mageia (botan, golang, kernel, kernel-linus, radare2/rizin, and xterm), Red Hat (krb5, varnish, and varnish:6), SUSE (busybox, chromium, erlang, exiv2, firefox, freerdp, ganglia-web, java-1_8_0-openj9, nodejs12, nodejs14, opera, pixman, python3, sudo, tiff, and xen), [...] --------------------------------------------- https://lwn.net/Articles/916135/ ∗∗∗ Cisco ISE Vulnerabilities Can Be Chained in One-Click Exploit ∗∗∗ --------------------------------------------- Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow remote attackers to inject arbitrary commands, bypass existing security protections, or perform cross-site scripting (XSS) attacks. --------------------------------------------- https://www.securityweek.com/cisco-ise-vulnerabilities-can-be-chained-one-c… ∗∗∗ Google Projekt Zero legt Schwachstelle in Mali GPU offen, Millionen Android-Geräte betroffen ∗∗∗ --------------------------------------------- Google Sicherheitsforscher haben im Project Zero eine Schwachstelle (CVE-2022-33917) im Kerneltreiber der in vielen Android-Geräten mit ARM CPU verwendeten Mali GPU offen gelegt. --------------------------------------------- https://www.borncity.com/blog/2022/11/27/google-projekt-zero-legt-schwachst… ∗∗∗ Security Bulletin: IBM Maximo Mobile is vulnerable to Information Disclosure (CVE-2022-41732) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-mobile-is-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect App Connect Professional. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to X-Force 237819 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ MISP v2.4.166 ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.166 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.11.2022
by Daily end-of-shift report 25 Nov '22

25 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 24-11-2022 18:00 − Freitag 25-11-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Docker Hub repositories hide over 1,650 malicious containers ∗∗∗ --------------------------------------------- Over 1,600 publicly available Docker Hub images hide malicious behavior, including cryptocurrency miners, embedded secrets that can be used as backdoors, DNS hijackers, and website redirectors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/docker-hub-repositories-hide… ∗∗∗ Redacted Documents Are Not as Secure as You Think ∗∗∗ --------------------------------------------- Popular redaction tools don’t always work as promised, and new attacks can reveal hidden information, researchers say. --------------------------------------------- https://www.wired.com/story/redact-pdf-online-privacy/ ∗∗∗ Alte Social-Media-Konten löschen: Sicherheit durch weniger eigener Daten im Netz ∗∗∗ --------------------------------------------- Ungenutzte Social-Media-Accounts beinhalten persönliche Daten und bergen Sicherheitsrisiken. Unser Ratgeber zeigt, wie Sie veraltete Konten finden und löschen. --------------------------------------------- https://heise.de/-7321954 ∗∗∗ UEFI-BIOS mit bekannt unsicherem Code gespickt ∗∗∗ --------------------------------------------- In einem BIOS-Update fanden Experten mehrere OpenSSL-Versionen, teils mit uralten Sicherheitslücken. Das wirft ein Schlaglicht auf Risiken von PC-Firmware. --------------------------------------------- https://heise.de/-7351884 ∗∗∗ Word Documents Disguised as Normal MS Office URLs Being Distributed ∗∗∗ --------------------------------------------- Recently, there has been a case of malware disguised as a Word document being distributed through certain paths (e.g. KakaoTalk group chats). The ASEC analysis team has discovered during our additional monitoring process that the URL used in the fake Word document is becoming very cleverly disguised to closely resemble the normal URL, and we wish to advise caution on the part of users. --------------------------------------------- https://asec.ahnlab.com/en/42554/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (firefox), Mageia (dropbear, freerdp, java, libx11, and tumbler), Slackware (ruby), SUSE (erlang, grub2, libdb-4_8, and tomcat), and Ubuntu (exim4, jbigkit, and tiff). --------------------------------------------- https://lwn.net/Articles/915984/ ∗∗∗ Chrome 107.0.5304.121/122 Sicherheitsupdates ∗∗∗ --------------------------------------------- Google hat zum 24. November 2022 einen Schwung an Sicherheitsupdates des Google Chrome im 107er Zweig im Stable Channel für Mac, Linux und Windows sowie für Android freigegeben. Es werden dabei bereits ausgenutzte Schwachstellen geschlossen. --------------------------------------------- https://www.borncity.com/blog/2022/11/25/chrome-107-0-5304-121-122-sicherhe… ∗∗∗ Canon: Regarding vulnerability measure against buffer overflow for Laser Printers and Small Office Multifunction Printers (CVE-2022-43608) – 25 November 2022 ∗∗∗ --------------------------------------------- Multiple cases of buffer overflow vulnerabilities have been identified with Canon Laser Printers and Small Office Multifunctional Printers. A list of affected models is given below. --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2022-3676) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. (CVE-2022-35637) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2021-28167) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2021-41041) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.11.2022
by Daily end-of-shift report 24 Nov '22

24 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 23-11-2022 18:00 − Donnerstag 24-11-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Investigating a backdoored PyPi package targeting FastAPI applications ∗∗∗ --------------------------------------------- On November 23rd, 2022, the Datadog Security Labs team identified a utility Python package on PyPI related to FastAPI, fastapi-toolkit, that has likely been compromised by a malicious actor. --------------------------------------------- https://securitylabs.datadoghq.com/articles/malicious-pypi-package-fastapi-… ∗∗∗ THREAT ALERT: Aggressive Qakbot Campaign and the Black Basta Ransomware Group Targeting U.S. Companies ∗∗∗ --------------------------------------------- In this threat alert, the Cybereason team describes one attack scenario that started from a QBot infection, resulting in multiple key machines loading Cobalt Strike, which finally led to the global deployment of Black Basta ransomware. --------------------------------------------- https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and… ∗∗∗ MSI Afterburner: Vorsicht vor Fake-Software mit Trojaner im Gepäck ∗∗∗ --------------------------------------------- Immer wieder versuchen Kriminelle Opfern Schadcode unter dem Deckmantel von legitimen Tools, wie aktuell dem GPU-Tool MSI Afterburner, unterzuschieben. --------------------------------------------- https://heise.de/-7351380 ∗∗∗ In eine Phishing-Falle getappt? Das können Sie tun: ∗∗∗ --------------------------------------------- Wurden Sie über ein betrügerisches E-Mail oder SMS auf eine gefälschte Login-Seiten gelockt? Haben Sie dort Ihre Daten eingetippt? Dann haben Kriminelle Zugriff auf Ihr Konto. Wir zeigen Ihnen, was Sie tun können, wenn Sie Ihre Benutzerdaten preisgegeben haben. --------------------------------------------- https://www.watchlist-internet.at/news/in-eine-phishing-falle-getappt-das-k… ∗∗∗ Neue Betrugsmasche: Kriminelle stehlen Kreditkartendaten und hinterlegen sie für Apple Pay ∗∗∗ --------------------------------------------- Kriminelle erschleichen sich mit Phishing-Nachrichten per SMS oder E-Mail Kreditkartendaten und hinterlegen diese für Apple Pay. Betroffene werden dann unter falschen Vorwänden verleitet, den Aktivierungscode für Apple Pay an die Kriminellen weiterzugeben. --------------------------------------------- https://www.watchlist-internet.at/news/neue-betrugsmasche-kriminelle-stehle… ∗∗∗ Bahamut cybermercenary group targets Android users with fake VPN apps ∗∗∗ --------------------------------------------- Malicious apps used in this active campaign exfiltrate contacts, SMS messages, recorded phone calls, and even chat messages from apps such as Signal, Viber, and Telegram. --------------------------------------------- https://www.welivesecurity.com/2022/11/23/bahamut-cybermercenary-group-targ… ∗∗∗ IBM: RansomExx becomes latest ransomware group to create Rust variant ∗∗∗ --------------------------------------------- The RansomExx ransomware group has become the latest gang to create a variant in the Rust programming language, according to IBM Security X-Force Threat researchers. --------------------------------------------- https://therecord.media/ibm-ransomexx-becomes-latest-ransomware-group-to-cr… ===================== = Vulnerabilities = ===================== ∗∗∗ TP-Link RE300 V1 tdpServer vulnerable to improper processing of its input ∗∗∗ --------------------------------------------- tdpServer of TP-Link RE300 V1 improperly processes its input, possibly resulting to crash. --------------------------------------------- https://jvn.jp/en/jp/JVN29657972/ ∗∗∗ Security update available in Foxit PDF Editor for Mac 11.1.4 ∗∗∗ --------------------------------------------- Foxit has released Foxit PDF Editor for Mac 11.1.4, which addresses potential security and stability issues. --------------------------------------------- https://www.foxit.com/support/security-bulletins.html ∗∗∗ SolarWinds Security Advisories 2022-11-22 ∗∗∗ --------------------------------------------- SolarWinds published 7 Security Advisories (3 High, 1 Medium, 3 Low Severity). --------------------------------------------- https://www.solarwinds.com/trust-center/security-advisories ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (vim), Fedora (drupal7-context, drupal7-link, firefox, xen, xorg-x11-server, and xorg-x11-server-Xwayland), Oracle (container-tools:ol8, device-mapper-multipath, dotnet7.0, firefox, hsqldb, keylime, podman, python3.9, python39:3.9, thunderbird, and xorg-x11-server), SUSE (exiv2-0_26, keylime, libarchive, net-snmp, nginx, opensc, pixman, python-joblib, strongswan, and webkit2gtk3), and Ubuntu (expat, imagemagick, mariadb-10.3, mariadb-10.6, [...] --------------------------------------------- https://lwn.net/Articles/915929/ ∗∗∗ Security Bulletin: IBM Sterling Control Center vulnerable to multiple issues to due IBM Cognos Analystics (CVE-2022-4160, CVE-2021-3733) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent… ∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service due to Websphere Liberty (CVE-2022-24839) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent… ∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to HTTP header injection due to Websphere Liberty (CVE-2022-34165) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent… ∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK affects Cloud Pak System [CVE-2021-28167] ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to unauthenticated data manipulation due to Java SE (CVE-2021-2163) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent… ∗∗∗ Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-for-ibm-cloudpak-for-wats… ∗∗∗ Security Bulletin: Vulnerabilities with MariaDB affect IBM Cloud Object Storage Systems (Nov 2022v1) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-mari… ∗∗∗ Pilz: PAS 4000 prone to ZipSlip ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-045/ ∗∗∗ Pilz: Multiple products affected by ZipSlip ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-044/ ∗∗∗ Pilz: PASvisu and PMI affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-033/ ∗∗∗ 2022-18Multiple vulnerabilities in BAT-C2 ∗∗∗ --------------------------------------------- https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15087-sour… ∗∗∗ 2022-21Authenticated Command Injection in Hirschmann BAT-C2 ∗∗∗ --------------------------------------------- https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15088-sour… ∗∗∗ 2022-20TinyXML vulnerability in Hirschmann HiLCOS products ∗∗∗ --------------------------------------------- https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15089-sour… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.11.2022
by Daily end-of-shift report 23 Nov '22

23 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 22-11-2022 18:00 − Mittwoch 23-11-2022 18:00 Handler: Robert Waldner Co-Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Backdoored Chrome extension installed by 200,000 Roblox players ∗∗∗ --------------------------------------------- Chrome browser extension SearchBlox installed by more than 200,000 users has been discovered to contain a backdoor that can steal your Roblox credentials as well as your assets on Rolimons, a Roblox trading platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/backdoored-chrome-extension-… ∗∗∗ Ducktail Malware Operation Evolves with New Malicious Capabilities ∗∗∗ --------------------------------------------- The operators of the Ducktail information stealer have demonstrated a "relentless willingness to persist" and continued to update their malware as part of an ongoing financially driven campaign."The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victims Facebook account," ... --------------------------------------------- https://thehackernews.com/2022/11/ducktail-malware-operation-evolves-with.h… ∗∗∗ Mind the Gap ∗∗∗ --------------------------------------------- Note: The vulnerabilities discussed in this blog post (CVE-2022-33917) are fixed by the upstream vendor, but at the time of publication, these fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung, Xiaomi, Oppo and others). Devices with a Mali GPU are currently vulnerable. --------------------------------------------- https://googleprojectzero.blogspot.com/2022/11/mind-the-gap.html ∗∗∗ Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice ∗∗∗ --------------------------------------------- In September 2022, Proofpoint researchers identified initial delivery of a penetration testing framework called Nighthawk. Launched in late 2021 by MDSec, Nighthawk is similar to other frameworks such as Brute Ratel and Cobalt Strike and, like those, could see rapid adoption by threat actors wanting to diversify their methods and add a relatively unknown framework to their arsenal. --------------------------------------------- https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pent… ∗∗∗ Kritische Infrastruktur: EU-Richtlinie nimmt Betreiber in die Pflicht ∗∗∗ --------------------------------------------- Das EU-Parlament hat eine Richtlinie zur Resilienz kritischer Einrichtungen beschlossen. Sie gilt für elf Branchen. Manche Betreiber sind besonders wichtig. --------------------------------------------- https://heise.de/-7349574 ∗∗∗ Google will Missbrauch des Pentesting-Tools Cobalt Strike eindämmen ∗∗∗ --------------------------------------------- Damit Admins Netzwerk-Attacken durch Cobalt-Strike-Missbrauch besser erkennen können, hat Google unter anderem Erkennungsregeln auf Yara-Basis veröffentlicht. --------------------------------------------- https://heise.de/-7349813 ∗∗∗ Standard für maschinenlesbare Sicherheitshinweise verabschiedet ∗∗∗ --------------------------------------------- Das Common Security Advisory Framework soll Administratoren die Arbeit erleichtern und aktuelle Sicherheitsinformationen leichter auffindbar machen. --------------------------------------------- https://heise.de/-7350491 ∗∗∗ Angriffe auf Boa Web Server gefährden IoT ∗∗∗ --------------------------------------------- Anfällige SDK-Komponenten führen zu Lieferkettenrisiken in IoT- und OT-Umgebungen, insbesondere durch den veralteten Boa Web Server, warnt Microsoft Security Threat Intelligence (MSTI). --------------------------------------------- https://www.zdnet.de/88405186/angriffe-auf-boa-web-server-gefaehrden-iot/ ∗∗∗ Web Application Firewalls umgehen ∗∗∗ --------------------------------------------- Web Application Firewalls (WAFs) sind beliebte Infrastrukturkomponenten, die verwendet werden, um Angriffe auf Webanwendungen zu erschweren. Was bieten WAFs wirklich? Können sie auch nur theoretisch perfekt sein, um jede Art von Webangriff zu verhindern? Lassen Sie uns WAFs entmystifizieren! --------------------------------------------- https://certitude.consulting/blog/de/web-application-firewalls-umgehen/ ∗∗∗ CVE-2022-23088: Exploiting a Heap Overflow in the FreeBSD Wi-Fi Stack ∗∗∗ --------------------------------------------- In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. [..] The researcher has graciously provided this detailed write-up of the vulnerability and a proof-of-concept exploit demonstrating the bug. --------------------------------------------- https://www.thezdi.com/blog/2022/6/15/cve-2022-23088-exploiting-a-heap-over… ∗∗∗ CVE-2022-40300: SQL Injection in ManageEngine Privileged Access Management ∗∗∗ --------------------------------------------- In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Justin Hung and Dusan Stevanovic of the Trend Micro Research Team detail a recently patched SQL injection vulnerability in Zoho ManageEngine products. --------------------------------------------- https://www.thezdi.com/blog/2022/11/22/cve-2022-40300-sql-injection-in-mana… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-11-22 ∗∗∗ --------------------------------------------- IBM Operations Analytics, IBM QRadar, IBM SDK, IBM Sterling Connect, Rational Service Tester, Rational Performance Tester, IBM HTTP Server, IBM Security Verify Governance, IBM InfoSphere DataStage, IBM Cloud Pak for Security --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Sicherheitslücke in HPE-Switches OfficeConnect gefährdet Netzwerke ∗∗∗ --------------------------------------------- Angreifer könnten Switches von Hewlett Packard Enterprise attackieren. Sicherheitsupdates stehen zum Download bereit. --------------------------------------------- https://heise.de/-7350116 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (heimdal, libarchive, and nginx), Fedora (varnish-modules and xterm), Red Hat (firefox), Scientific Linux (firefox, hsqldb, and thunderbird), SUSE (Botan, colord, containerized-data-importer, ffmpeg-4, java-1_8_0-ibm, krb5, nginx, redis, strongswan, tomcat, and xtrabackup), and Ubuntu (apr-util, freerdp2, and sysstat). --------------------------------------------- https://lwn.net/Articles/915802/ ∗∗∗ CISA Releases Eight Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- Original release date: November 22, 2022CISA has released eight (8) Industrial Control Systems (ICS) advisories on 22 November 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. - ICSA-22-326-01 AVEVA Edge - ICSA-22-326-02 Digital Alert Systems DASDEC - ICSA-22-326-03 Phoenix Contact Automation Worx - ICSA-22-326-04 GE Cimplicity - ICSA-22-326-05 Moxa Multiple ARM-Based Computers - ICSMA-21-152-01 Hillrom Medical Device Management (Update C) - ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update I) - ICSA-21-049-02 Mitsubishi Electric FA Engineering Software Products (Update G) --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/11/22/cisa-releases-eig… ∗∗∗ WordPress BeTheme 26.5.1.4 PHP Object Injection ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2022110040 ∗∗∗ Security Advisory - Improper Input Validation Vulnerability in a Huawei Childrens Watch ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iivviahcw… ∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in some Huawei Band Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20221130-… ∗∗∗ Multiple Vulnerabilities PRA-ES8P2S Ethernet-Switch ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-247053-bt.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.11.2022
by Daily end-of-shift report 22 Nov '22

22 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Montag 21-11-2022 18:00 − Dienstag 22-11-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Google Chrome extension used to steal cryptocurrency, passwords ∗∗∗ --------------------------------------------- An information-stealing Google Chrome browser extension named VenomSoftX is being deployed by Windows malware to steal cryptocurrency and clipboard contents as users browse the web. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-chrome-extension-used… ∗∗∗ Android file manager apps infect thousands with Sharkbot malware ∗∗∗ --------------------------------------------- A new collection of malicious Android apps posing as harmless file managers had infiltrated the official Google Play app store, infecting users with the Sharkbot banking trojan. --------------------------------------------- https://www.bleepingcomputer.com/news/security/android-file-manager-apps-in… ∗∗∗ ICS cyberthreats in 2023 – what to expect ∗∗∗ --------------------------------------------- The coming year looks to be much more complicated. In the post we share some of our thoughts on potential developments of 2023, though we cannot claim to be providing either a complete picture or a high degree of precision. --------------------------------------------- https://securelist.com/ics-cyberthreats-in-2023/108011/ ∗∗∗ Crimeware and financial cyberthreats in 2023 ∗∗∗ --------------------------------------------- This report assesses how accurately we predicted the developments in the financial threats landscape in 2022 and ponder at what to expect in 2023. --------------------------------------------- https://securelist.com/crimeware-financial-cyberthreats-2023/108005/ ∗∗∗ Log4Shell campaigns are using Nashorn to get reverse shell on victims machines, (Mon, Nov 21st) ∗∗∗ --------------------------------------------- Almost one year later, Log4Shell attacks are still alive and making victims. --------------------------------------------- https://isc.sans.edu/diary/rss/29266 ∗∗∗ Researchers Warn of Cyber Criminals Using Go-based Aurora Stealer Malware ∗∗∗ --------------------------------------------- A nascent Go-based malware known as Aurora Stealer is being increasingly deployed as part of campaigns designed to steal sensitive information from compromised hosts. --------------------------------------------- https://thehackernews.com/2022/11/researchers-warn-of-cyber-criminals.html ∗∗∗ Werbung für beheizbare Jacken auf TikTok ∗∗∗ --------------------------------------------- Haben Sie beim Durchscrollen von TikTok Werbung für eine beheizbare Jacke gesehen? Dann sind Sie wohl über die Marke „Mont Gerrard“ gestolpert. Die Jacken dürften bei TikTok-Nutzer:innen sehr beliebt sein, denn es gibt bereits Fake-Shops, die die Jacken zu einem günstigeren Preis anbieten und auf TikTok und Instagram bewerben. --------------------------------------------- https://www.watchlist-internet.at/news/werbung-fuer-beheizbare-jacken-auf-t… ∗∗∗ Vulnerability Spotlight: Callback Technologies CBFS Filter denial-of-service vulnerabilities ∗∗∗ --------------------------------------------- Cisco Talos recently discovered three denial-of-service vulnerabilities in Callback Technologies CBFS Filter. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-spotlight-callback-technol… ∗∗∗ What is EPSS? A new rating system for vulnerabilities to replace CVSS. ∗∗∗ --------------------------------------------- LunaSec Security Researchers give a quick look at the EPSS scoring system, a new rating system for vulnerabilities that aims to replace CVSS. --------------------------------------------- https://www.lunasec.io/docs/blog/what-is-epss ===================== = Vulnerabilities = ===================== ∗∗∗ Attacken auf Backuplösung IBM Spectrum Protect Plus Container Backup möglich ∗∗∗ --------------------------------------------- Sicherheitslücken in der Programmiersprache Golang Go bedrohen IBM-Software. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-7348556 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ntfs-3g), Fedora (krb5 and samba), Gentoo (firefox-bin, ghostscript-gpl, pillow, sudo, sysstat, thunderbird-bin, and xterm), Red Hat (firefox, hsqldb, and thunderbird), SUSE (cni, cni-plugins, and krb5), and Ubuntu (isc-dhcp and sqlite3). --------------------------------------------- https://lwn.net/Articles/915708/ ∗∗∗ BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks ∗∗∗ --------------------------------------------- Researchers at industrial cybersecurity firm Nozomi Networks have discovered more than a dozen vulnerabilities in baseboard management controller (BMC) firmware. --------------------------------------------- https://www.securityweek.com/bmc-firmware-vulnerabilities-expose-ot-iot-dev… ∗∗∗ ZDI-22-1615: TP-Link TL-WR940N httpd Incorrect Implementation of Authentication Algorithm Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-22-1615/ ∗∗∗ ZDI-22-1614: TP-Link TL-WR940N httpd Use of Insufficiently Random Values Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-22-1614/ ∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of dom4j (CVE-2018-1000632) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover… ∗∗∗ Security Bulletin: Potential Vulnerability in Apache HttpClient used by Logstash shipped with IBM Operations Analytics – Log Analysis (CVE-2020-13956) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-i… ∗∗∗ Security Bulletin: Vulnerability from Apache Kafka affect IBM Operations Analytics – Log Analysis (CVE-2018-17196) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-from-apache… ∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis susceptible to vulnerability in Apache Tika (CVE-2022-25169) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-… ∗∗∗ Security Bulletin: Vulnerabilities in SnakeYAML used by Logstash affects IBM Operations Analytics – Log Analysis (CVE-2022-25857, CVE-2017-18640) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-snakey… ∗∗∗ Security Bulletin: IBM DataPower Gateway does not invalidate active sessions on a password change (CVE-2022-40228) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-doe… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. (CVE-2022-22483) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM DataPower Gateway potentially vulnerable to HTTP request smuggling ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-pot… ∗∗∗ Security Bulletin: Vulnerability in Bouncy Castle used by Logstash shipped with IBM Operations Analytics – Log Analysis (CVE-2017-13098) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bouncy-c… ∗∗∗ Vulnerability Summary for the Week of November 14, 2022 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/bulletins/sb22-325 ∗∗∗ Advisory: Impact of Vulnerability in WIBU CodeMeter Runtime to B&R Products ∗∗∗ --------------------------------------------- https://www.br-automation.com/downloads_br_productcatalogue/assets/16677451… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.11.2022
by Daily end-of-shift report 21 Nov '22

21 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 18-11-2022 18:00 − Montag 21-11-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New AxLocker ransomware encrypts files, then steals your Discord account ∗∗∗ --------------------------------------------- The new AXLocker ransomware family is not only encrypting victims files and demanding a ransom payment but also stealing the Discord accounts of infected users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-axlocker-ransomware-encr… ∗∗∗ Apps with over 3 million installs leak Admin search API keys ∗∗∗ --------------------------------------------- Researchers discovered 1,550 mobile apps leaking Algolia API keys, risking the exposure of sensitive internal services and stored user information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apps-with-over-3-million-ins… ∗∗∗ Google releases 165 YARA rules to detect Cobalt Strike attacks ∗∗∗ --------------------------------------------- The Google Cloud Threat Intelligence team has open-sourced YARA Rules and a VirusTotal Collection of indicators of compromise (IOCs) to help defenders detect Cobalt Strike components in their networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-releases-165-yara-rul… ∗∗∗ McAfee Fake Antivirus Phishing Campaign is Back!, (Sat, Nov 19th) ∗∗∗ --------------------------------------------- Yesterday I received this email that my McAfee antivirus subscription is expired and that my computer is already infected with 5 viruses (how do they know?). --------------------------------------------- https://isc.sans.edu/diary/rss/29264 ∗∗∗ Vulnerable Code Snippets ∗∗∗ --------------------------------------------- YesWeHack present code snippets containing several different vulnerabilities to practice your code analysis. The code snippets are beginner friendly but suitable for all levels! --------------------------------------------- https://github.com/yeswehack/vulnerable-code-snippets ∗∗∗ A Confused Deputy Vulnerability in AWS AppSync ∗∗∗ --------------------------------------------- We have identified a cross-tenant vulnerability in Amazon Web Services (AWS) that exploits AWS AppSync. This attack abuses the AppSync service to assume IAM roles in other AWS accounts, which allows an attacker to pivot into a victim organization and access resources in those accounts. --------------------------------------------- https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosur… ∗∗∗ 5 free resources from the Cybersecurity and Infrastructure Security Agency (CISA) ∗∗∗ --------------------------------------------- To assist businesses in enhancing their security capabilities, CISA offers free cybersecurity products and services. --------------------------------------------- https://www.helpnetsecurity.com/2022/11/21/5-free-resources-cybersecurity-a… ∗∗∗ Gefälschtes SMS von Netflix droht mit Kontosperrung ∗∗∗ --------------------------------------------- Aktuell macht ein Netflix-SMS die Runde. Darin steht, dass Sie eine Rechnung nicht bezahlt haben. Daher droht man Ihnen mit einer Kontosperrung. Im SMS befindet sich auch ein Link. Klicken Sie nicht auf den Link, Kriminelle stehlen Ihre Netflix-Zugangsdaten. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-sms-von-netflix-droht-m… ∗∗∗ An AI Based Solution to Detecting the DoubleZero .NET Wiper ∗∗∗ --------------------------------------------- Unit 42 presents a machine learning model to predict maliciousness of .NET samples based on file structures, by analyzing the DoubleZero .NET wiper. --------------------------------------------- https://unit42.paloaltonetworks.com/doublezero-net-wiper/ ∗∗∗ Reputationsverlust durch Cyberangriffe ∗∗∗ --------------------------------------------- Die am meisten befürchteten Schäden durch Cyberangriffe sind finanzielle Schäden sowie Verlust von Reputation und Kundenvertrauen. Bei der Umsetzung von Cybersicherheitsmaßnahmen stehen jedoch Schutz von Geschäftskontinuität, Daten und Kunden im Vordergrund. --------------------------------------------- https://www.zdnet.de/88405082/reputationsverlust-durch-cyberangriffe/ ∗∗∗ Luna Moth: Erfolg mit Callback-Phishing ∗∗∗ --------------------------------------------- Die Luna Moth/Silent Ransom Kriminellen erbeuteten durch Callback-Phishing Hunderttausende von Euro, wie eine Analyse von Palo Alto Networks aufdeckt. --------------------------------------------- https://www.zdnet.de/88405109/luna-moth-erfolg-mit-callback-phishing/ ===================== = Vulnerabilities = ===================== ∗∗∗ Exploit released for actively abused ProxyNotShell Exchange bug ∗∗∗ --------------------------------------------- Proof-of-concept exploit code has been released online for two actively exploited and high-severity vulnerabilities in Microsoft Exchange, collectively known as ProxyNotShell. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-activel… ∗∗∗ New attacks use Windows security bypass zero-day to drop malware ∗∗∗ --------------------------------------------- New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-attacks-use-windows-secu… ∗∗∗ IBM Security Bulletins 2022-11-18 ∗∗∗ --------------------------------------------- Power HMC, InfoSphere Information Server, IBM Operations Analytics, IBM i Access Client Solutions, IBM DataPower Gateway, IBM Tivoli, IBM Spectrum Protect Plus --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (graphicsmagick and krb5), Fedora (dotnet6.0, js-jquery-ui, kubernetes, and xterm), Gentoo (php and postgresql), Mageia (php-pear-CAS, sysstat, varnish, vim, and x11-server), Red Hat (thunderbird), SUSE (389-ds, binutils, dpkg, firefox, frr, grub2, java-11-openjdk, java-17-openjdk, kernel, kubevirt stack, libpano, nodejs16, openjpeg, php7, php74, pixman, python-Twisted, python39, rubygem-loofah, sccache, sudo, thunderbird, tor, and tumbler), [...] --------------------------------------------- https://lwn.net/Articles/915623/ ∗∗∗ PoC Code Published for High-Severity macOS Sandbox Escape Vulnerability ∗∗∗ --------------------------------------------- A security researcher has published details and proof-of-concept (PoC) code for a macOS vulnerability that could be exploited to escape a sandbox and execute code within Terminal. --------------------------------------------- https://www.securityweek.com/poc-code-published-high-severity-macos-sandbox… ∗∗∗ Typora fails to properly neutralize JavaScript code ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN26044739/ ∗∗∗ MISP 2.4.165 released with many improvements, bugs fixed and security fixes. ∗∗∗ --------------------------------------------- https://www.misp-project.org/2022/11/21/MISP.2.4.165.released.html/ ∗∗∗ Miele: Vulnerability in ease2pay cloud service used by appWash ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-052/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily