A Zero-Day vulnerability in VBScript was disclosed to Microsoft. The vulnerability was discovered as an active attack in the wild. The bug is in the VBScript engine used in Windows. Its classified as a Use-After-Free (UAF) vulnerability. CVE-2017-8174 is assigned to track this bug. Currently attackers are exploiting this vulnerability to execute shellcode and PowerShell … Continue reading “Internet Explorer VBScript Use-After-Free Vulnerability: CVE-2018-8174”
Category: ThreatPROTECT
Oracle WebLogic Deserialization Vulnerability : CVE-2018-2628
A deserialization vulnerability was discovered in Oracle WebLogic server’s core components. Upon successful exploitation an attacker can take control of the target server. The exploit targets the server by sending a custom serialized object using T3 protocol and achieves remote arbitrary code execution. T3 and T3S(T3 over TLS) protocol is used to exchange data between … Continue reading “Oracle WebLogic Deserialization Vulnerability : CVE-2018-2628”
Drupal Critical RCE Patch Release [CVE-2018-7602]
Drupal released a critical update to address CVE-2018-7602. Upon exploiting the bug an attacker can gain remote code execution that can compromise the site. The vulnerability affects Drupal 7.x and 8.x. The vulnerability was disclosed by Drupal’s in house team. A similar bug (CVE-2018-7600) was patched SA-CORE-2018-002. Both of these vulnerabilities are being exploited in the wild. … Continue reading “Drupal Critical RCE Patch Release [CVE-2018-7602]”
Dell EMC Avamar and Integrated Data Protection Appliance (IDPA) Installation Manager Missing Access Control Vulnerability (DSA-2018-025)
EMC Avamar Virtual Edition is great for enterprise backup data protection for small and medium-sized offices. Avamar Virtual Edition is optimized for backup and recovery of virtual and physical servers, enterprise applications, remote offices, and desktops or laptops. Avamar Installation Manager is affected by a missing access control check vulnerability which could potentially allow a … Continue reading “Dell EMC Avamar and Integrated Data Protection Appliance (IDPA) Installation Manager Missing Access Control Vulnerability (DSA-2018-025)”
Drupal Critical RCE Patch Release [CVE-2018-7600]
On 21 March 2018 Drupal released a statement that a major vulnerability was reported. They have rated this vulnerability as critical. As per their statement “exploits might be developed within hours or days”, Due to the severity of the issue Drupal is releasing patches for unsupported version as well. CVE-2018-7600 has been assigned to track this issue. Drupal security … Continue reading “Drupal Critical RCE Patch Release [CVE-2018-7600]”
HP Intelligent Management Center (iMC) RMI Registry Java Deserialization Remote Code Execution Vulnerability
HPE Intelligent Management Center Enterprise Software Platform is a comprehensive wired and wireless network management tool supporting the FCAPS model, provides for end-to-end business management of IT, scalability of system architecture, and accommodation of new technology and infrastructure. Vulnerability: A deserialization vulnerability has been reported in the HPE Intelligent Management Center (iMC). The vulnerability is … Continue reading “HP Intelligent Management Center (iMC) RMI Registry Java Deserialization Remote Code Execution Vulnerability”
Vulnerabilities in AMD Processors RYZEN and EPYC
Various vulnerabilities have been discovered in AMD’s Zen architecture based processors – Ryzen and EPYC. Ryzen processors are aimed towards workstations, laptops and mobiles and EPYC is geared towards servers. The vulnerabilities have been discovered by CTS-Labs, they claim that attackers can exploit these vulnerabilities to : Inject malicious code in to the chip itself. … Continue reading “Vulnerabilities in AMD Processors RYZEN and EPYC”
Memcached Amplification Attacks
Memcached is high-performance distributed system for caching. It was designed yo improve web application performance by reducing database load. An amplification attack using the memcached protocol was observed in the wild. The attack is carried over UDP port 11211. Amplification attacks requires an attacker to forge the IP address of the target and send a … Continue reading “Memcached Amplification Attacks”
Qualys Discloses Multiple Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Qualys Security Research Team has disclosed multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Citrix has addressed these vulnerabilities in CTX232161. The affected versions and CVEs are listed below. CVE(s) Description Product Affected Version : Build CVE-2018-6810 Directory Traversal Vulnerability Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway < 12.0 : 57.19 < 11.1 : … Continue reading “Qualys Discloses Multiple Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway”
LibreOffice Remote Arbitrary File Disclosure Vulnerability via WEBSERVICE Function
LibreOffice Calc is the spreadsheet component of the LibreOffice software package. LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. Details: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via WEBSERVICE calls in a document (CVE-2018-6871), which uses the COM.MICROSOFT.WEBSERVICE function. This feature is available in Microsoft … Continue reading “LibreOffice Remote Arbitrary File Disclosure Vulnerability via WEBSERVICE Function”