Overview Recently, Oracle released its critical October update to patch CVE-2020-14882. Oracle WebLogic Server has now observed that attackers can now bypass this patch exposing an unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2020-14750). As per CVE-2020-14750, unauthorized attackers can continue to bypass the WebLogic background login restrictions and control the server even after WebLogic is … Continue reading “Oracle WebLogic Server Unauthenticated Remote Code Execution Vulnerability (CVE-2020-14750)”
Author: Dhiren Vaghela
Publicly-known Vulnerabilities Exploited by State-sponsored Cyber Threat Actors
In the start of Oct 2020, Cybersecurity and Infrastructure Security Agency (CISA) published an advisory notifying about vulnerabilities that were exploited in the wild to retrieve sensitive data such as intellectual property, economic, political, as well as military information. According to CISA, in the light of heightened tensions between U.S. and China, these vulnerabilities were … Continue reading “Publicly-known Vulnerabilities Exploited by State-sponsored Cyber Threat Actors”
Microsoft Windows Critical RCE Vulnerability – Bad Neighbor (CVE-2020-16898)
Multiple vulnerabilities were addressed in Microsoft Patch Tuesday, October 2020. This blog discusses the most critical one out of them – CVE-2020-16898, which makes TCP/IP driver of Windows vulnerable. It eventually causes Denial of Service (DoS) and is said to be a potential Remote Code Execution (RCE), if mixed with other exploits. This CVE is … Continue reading “Microsoft Windows Critical RCE Vulnerability – Bad Neighbor (CVE-2020-16898)”
Pulse Connect Secure authenticated RCE vulnerability (CVE-2020-8243)
Recently, a Perl template injection vulnerability that leads to Remote Code Execution (RCE) was observed in Pulse Connect Secure (PCS) appliances, which was identified as CVE-2020-8243. Credits to identify this CVE goes to Richard Warren and David Cash of NCC group. An authenticated user would be able to inject arbitrary code if the user has … Continue reading “Pulse Connect Secure authenticated RCE vulnerability (CVE-2020-8243)”
Cisco IOS and IOS XE Multiple Vulnerabilities
Multiple vulnerabilities including authorization bypass, DoS, arbitrary code execution and such other critical vulnerabilities were observed in various Cisco IOS and IOS XE devices in September 2020. To this, Cisco published a collated report of all 34 vulnerabilities as an advisory – ERP-74268. In its semi-annual report, published on Sept 24, 2020, Cisco released bundles … Continue reading “Cisco IOS and IOS XE Multiple Vulnerabilities”
VPN Vulnerabilities Exploited in the Wild
The Cybersecurity and Infrastructure Security Agency (CISA), with contributions from the Federal Bureau of Investigation (FBI), has published a report detailing nefarious activities originating in Iran, targeting several U.S. agencies. Pioneer Kitten and UNC757 were named as malicious actors in the report. Using various tactics, techniques and procedures (TTPs), it was reported that the affected … Continue reading “VPN Vulnerabilities Exploited in the Wild”
Microsoft Windows Netlogon Privilege Escalation Vulnerability (CVE-2020-1472)
A severe bug identified as CVE-2020-1472 with a criticality of 10 is being exploited publicly in the wild. This bug can take over Windows Servers running as Domain Controllers with domain-level privileges from a remote unauthenticated user. A Dutch team, collectively known as Secura, has published an exploit on Github with a technical writeup. According … Continue reading “Microsoft Windows Netlogon Privilege Escalation Vulnerability (CVE-2020-1472)”
PAN-OS Buffer overflow vulnerability (CVE-2020-2040)
Within a span of three months, one more critical vulnerability with a score of 10.0 has been observed in PAN-OS devices. When a Captive Portal or Multi-factor authentication interface is enabled on PAN-OS devices, it is considered to be vulnerable to critical buffer overflow vulnerability. This vulnerability is classified as CWE-120 and assigned CVE-2020-2040, on … Continue reading “PAN-OS Buffer overflow vulnerability (CVE-2020-2040)”
Apache HTTP2 Header Memory Corruption Vulnerability (CVE-2020-9490, CVE-2020-11984, CVE-2020-11993)
Summary Apache, officially known as Apache HTTP Server, is an open-source and free web server software that powers most of the websites around the world. Recently, one Critical and two High severity flaws were fixed in Apache httpd 2.4.44. These flaws were tracked as CVE-2020-9490, CVE-2020-11984, and CVE-2020-11993 – out of which, CVE-2020-9490 is the … Continue reading “Apache HTTP2 Header Memory Corruption Vulnerability (CVE-2020-9490, CVE-2020-11984, CVE-2020-11993)”
Apache Struts 2 Remote Code Execution Vulnerability (CVE-2019-0230, CVE-2019-0233)
Apache Struts Security Team has addressed two possible RCE bugs – CVE-2019-0230 and CVE-2019-0233 in their latest advisories published on August 13, 2020. Description Struts 2 is an open source coding framework for companies to create Java-based applications. The installations of Apache Struts 2, which are outdated, can be tentatively used to exploit CVE-2019-0230 as … Continue reading “Apache Struts 2 Remote Code Execution Vulnerability (CVE-2019-0230, CVE-2019-0233)”
