{"id":17666,"date":"2023-04-17T08:15:56","date_gmt":"2023-04-17T15:15:56","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=17666"},"modified":"2023-04-24T10:09:23","modified_gmt":"2023-04-24T17:09:23","slug":"securins-threat-intelligence-apr-17-2023-apr-21-2023","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-apr-17-2023-apr-21-2023\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: Apr 17, 2023 &#8211; Apr 21, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"17666\" class=\"elementor elementor-17666\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02c8318 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02c8318\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ddbe16e\" data-id=\"ddbe16e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3fa264 elementor-widget elementor-widget-text-editor\" data-id=\"a3fa264\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: left;\"><strong><span style=\"color: #000000;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d81a1c5 elementor-widget elementor-widget-heading\" data-id=\"d81a1c5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Check out our Threat Intelligence Podcast hosted by David Rushton!\u200b<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8162975 elementor-widget elementor-widget-text-editor\" data-id=\"8162975\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding:50% 0 0 0;position:relative;\"><iframe src=\"https:\/\/player.vimeo.com\/video\/819988025?h=8193324143&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allow=\"autoplay; fullscreen; picture-in-picture\" allowfullscreen style=\"position:absolute;top:0;left:0;width:100%;height:100%;\" title=\"April 21_Securin Threat Intelligence PODCAST\"><\/iframe><\/div><script src=\"https:\/\/player.vimeo.com\/api\/player.js\"><\/script>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f513b4 elementor-widget elementor-widget-spacer\" data-id=\"0f513b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06e09ce elementor-widget elementor-widget-heading\" data-id=\"06e09ce\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7532f9 elementor-widget elementor-widget-text-editor\" data-id=\"d7532f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#CISA-Adds-Two-Vulnerabilities-to-the-KEV-Catalog\">CISA Adds Two Vulnerabilities to the KEV Catalog<\/a><\/li><li><a href=\"#Sandbox-Escape-PoC-Exploits-Available-for-VM2-Library\">Sandbox Escape PoC Exploits Available for VM2 Library<\/a><\/li><li><a href=\"#Nation-State-Threat-Actor-APT-35-Refines-Tradecraft-Attacks-High-Value-Targets\">Nation-State Threat Actor APT 35 Refines Tradecraft, Attacks High-Value Targets<\/a><\/li><li><a href=\"#CVE-2020-1054-CVE-2021-1732-Raspberry-Robin\">CVE-2020-1054 &amp; CVE-2021-1732: Raspberry Robin<\/a><\/li><li><a href=\"#CVE-2017-6742-Jaguar-Tooth-Leveraging-Cisco-IOS-Vulnerability\">CVE-2017-6742: Jaguar Tooth Leveraging Cisco IOS Vulnerability<\/a><\/li><li><a href=\"#Microsoft-SQL-Servers-Hacked-to-Deploy-Trigona-Ransomware\">Microsoft SQL Servers Hacked to Deploy Trigona Ransomware<\/a><\/li><li><a href=\"#Hacktivist-Threat-Actor-Group-Targets-South-Korea-and-Taiwan\"><span style=\"font-weight: 400;\">Hacktivist Threat Actor Group Targets South Korea and Taiwan<\/span><\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45e16b3 elementor-widget elementor-widget-heading\" data-id=\"45e16b3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78d7bb2 elementor-widget elementor-widget-text-editor\" data-id=\"78d7bb2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#CVE-2023-2136-Google-Chrome-Zero-Day\"><span style=\"font-weight: 400;\">CVE-2023-2136: Google Chrome Zero-Day<\/span><\/a><\/li><li><a href=\"#CVE-2023-2033-Chrome-Vulnerability\">CVE-2023-2033: Chrome Vulnerability<\/a><\/li><li><a href=\"#CVE-2023-25135-vBulletin-Vulnerability\">CVE-2023-25135: vBulletin Vulnerability<\/a><\/li><li><a href=\"#CVE-2023-29084-ManageEngine-Vulnerability\">CVE-2023-29084: ManageEngine Vulnerability<\/a><\/li><li><a href=\"#Critical-RCE-bug-in-PaperCut-Servers-Exploited-by-Attackers\">Critical RCE bug in PaperCut Servers Exploited by Attackers<\/a><\/li><li><a href=\"#CVE-2022-29844-Western-Digital-Vulnerability\">CVE-2022-29844: Western Digital Vulnerability<\/a><\/li><li><a href=\"#VMware-vRealize-Vulnerabilities\">VMware vRealize Vulnerabilities<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5581d4 elementor-widget elementor-widget-spacer\" data-id=\"c5581d4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1272e27 elementor-widget elementor-widget-heading\" data-id=\"1272e27\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585df2e elementor-widget elementor-widget-spacer\" data-id=\"585df2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-13dc0cf elementor-widget elementor-widget-heading\" data-id=\"13dc0cf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CISA Adds Two Vulnerabilities to the KEV Catalog<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252bc8 elementor-widget elementor-widget-menu-anchor\" data-id=\"d252bc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CISA-Adds-Two-Vulnerabilities-to-the-KEV-Catalog\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32bb1a4 elementor-widget elementor-widget-text-editor\" data-id=\"32bb1a4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-8526\" target=\"_blank\" rel=\"noopener\"><span>CVE-2019-8526<\/span><\/a><span> is a use-after-free memory management issue in Apple. An attacker can gain elevated privileges by exploiting this vulnerability. It is one of the vulnerabilities exploited by the DazzleSpy APT group. It was <\/span><a href=\"https:\/\/support.apple.com\/HT209600\" target=\"_blank\" rel=\"noopener\"><span>fixed<\/span><\/a><span> in the macOS Mojave update.<\/span><\/p><p><b>CISA added this vulnerability to the KEV Catalog on April 18, 2023.\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\"><br \/><strong>CVE-2023-2033 is covered in the <i>Vulnerabilities to Watch Out For section<\/i> in this blog.<\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9753be6 elementor-widget elementor-widget-spacer\" data-id=\"9753be6\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-606fd20 elementor-widget elementor-widget-menu-anchor\" data-id=\"606fd20\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"Sandbox-Escape-PoC-Exploits-Available-for-VM2-Library\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-642d530 elementor-widget elementor-widget-heading\" data-id=\"642d530\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Sandbox Escape PoC Exploits Available for VM2 Library<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d729be0 elementor-widget elementor-widget-text-editor\" data-id=\"d729be0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A new sandbox escape <\/span><a href=\"https:\/\/docs.google.com\/document\/d\/1d15Gdd71OYN0Rckv4xzPgaZ34ATbzIdbFBb7a3EZ8e0\/edit#\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">proof of concept exploit<\/span><\/a><span style=\"font-weight: 400;\"> was recently released that makes it possible to execute unsafe code on a host running VM2 sandbox.<\/span><\/p><p><span style=\"font-weight: 400;\">VM2, a specialized JavaScript sandbox, is used broadly by software tools to run and test untrusted code in isolated environments, thereby preventing the code from accessing the host\u2019s system resources or data.<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-7jxr-cg7f-gpgv\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-29017<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; This vulnerability can bypass sandbox protections to gain remote code execution rights on the host machine that is running the sandbox. It impacts all versions of VM2 from 3.9.14 and older. While no workaround is available for the vulnerability, it was patched in early April 2023.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-xj72-wvfv-8985\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-29199<\/span><\/a> <span style=\"font-weight: 400;\">&#8211; This is a source code transformer (exception sanitization logic) of VM2 for versions up to 3.9.15, and allows attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-ch3r-j5x3-6q2m\" target=\"_blank\" rel=\"noopener\"><span>CVE-2023-30547<\/span><\/a><span> &#8211; This is a critical exception sanitization vulnerability of the VM2 for versions up to 3.9.16 and carries a CVSS v3 score of 9.8. The vulnerability allows attackers to raise an unsanitized host exception in <\/span><span>handleException() <\/span><span>which can then be used to escape the sandbox and run arbitrary code in the host context.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af9e8f9 elementor-widget elementor-widget-spacer\" data-id=\"af9e8f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45cc2fa elementor-widget elementor-widget-menu-anchor\" data-id=\"45cc2fa\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"Nation-State-Threat-Actor-APT-35-Refines-Tradecraft-Attacks-High-Value-Targets\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36e06a5 elementor-widget elementor-widget-heading\" data-id=\"36e06a5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Nation-State Threat Actor APT 35 Refines Tradecraft, Attacks High-Value Targets <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a0aa0a elementor-widget elementor-widget-text-editor\" data-id=\"6a0aa0a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A subgroup of the Iranian nation-state threat actor, PHOSPHORUS (also tagged as APT 35) called Mint Sandstorm, has begun refining their arsenal. They have weaponized N-day vulnerabilities in common enterprise applications and conducted highly-targeted phishing attacks to infiltrate environments of interest. The subgroup targets both private and public sectors, including political parties, activists, individuals protesting about regimes in the Middle East, journalists and employees of government agencies and the Defense Industrial Base (DIB).<\/span><\/p><p><span style=\"font-weight: 400;\">APT 35 has been observed exploiting the following CVEs in their attacks:<\/span><\/p><ol><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">CVE-2022-47986 &#8211; <\/span><a href=\"https:\/\/www.securin.io\/securins-threat-intelligence-feb-20-2022-feb-24-2022\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">IBM Aspera Faspex\u00a0<\/span><\/a><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">CVE-2022-47966 &#8211; <\/span><a href=\"https:\/\/www.securin.io\/securins-threat-intelligence-january-30-2022-february-3-2023-2\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Zoho ManageEngine<\/span><\/a><span style=\"font-weight: 400;\">\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">CVE-2021-44228 &#8211; <\/span><a href=\"https:\/\/www.securin.io\/articles\/have-you-patched-the-apache-log4j-vulnerability-cve-2021-44228\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Apache Log4J2<\/span><\/a><\/li><li style=\"font-weight: 400;\" aria-level=\"1\">CVE-2021-45046 &#8211; <a href=\"https:\/\/www.securin.io\/articles\/have-you-patched-the-apache-log4j-vulnerability-cve-2021-44228\/\" target=\"_blank\" rel=\"noopener\"><span>Apache Log4J2<\/span><\/a><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a41495 elementor-widget elementor-widget-spacer\" data-id=\"6a41495\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f4b230a elementor-widget elementor-widget-menu-anchor\" data-id=\"f4b230a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2020-1054-CVE-2021-1732-Raspberry-Robin\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-47115b8 elementor-widget elementor-widget-heading\" data-id=\"47115b8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\"> CVE-2020-1054 &amp; CVE-2021-1732: Raspberry Robin<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-316d6ae elementor-widget elementor-widget-text-editor\" data-id=\"316d6ae\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Raspberry Robin has become one of the most distributed malware that is presently active, and has been leveraged by many threat actors such as IcedID and Cl0p ransomware to distribute their own malware.<\/span><\/p><p><span style=\"font-weight: 400;\">As the malware has continued to evolve, Raspberry Robin has developed an arsenal of unique tricks and evasive techniques. The malware affects Windows and Mac systems alike and leverages two vulnerabilities.<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2021-1732\" target=\"_blank\" rel=\"noopener\">CVE-2021-1732<\/a> &#8211; A Win32K window object type confusion that leads to an OOB (out-of-bounds) write. It was a zero-day in the wild and was used by Bitter APT. It runs on Windows 10, with a specific targeted build number range.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2020-1054\" target=\"_blank\" rel=\"noopener\">CVE-2020-1054<\/a> &#8211; This vulnerability checks if the package KB4601319 is present or not. It gets the HMValidateHandle from searching inside the IsMenu code for Oxe8 opcode. It then searches in the first 0x20 bytes for the opcode.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c2145a7 elementor-widget elementor-widget-spacer\" data-id=\"c2145a7\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-44a4f89 elementor-widget elementor-widget-menu-anchor\" data-id=\"44a4f89\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2017-6742-Jaguar-Tooth-Leveraging-Cisco-IOS-Vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e90ba9b elementor-widget elementor-widget-heading\" data-id=\"e90ba9b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2017-6742: Jaguar Tooth Leveraging Cisco IOS Vulnerability <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b0c866a elementor-widget elementor-widget-text-editor\" data-id=\"b0c866a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A joint report by US Cybersecurity and Infrastructure Security Agency (CISA), UK National Cyber Security Centre (NCSC), the NSA and the FBI, alongside Cisco was issued warning about Russian APT 28 hackers deploying a custom malware called Jaguar Tooth on Cisco IOS Routers, allowing them unauthenticated access to the device.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Jaguar Tooth has been observed being deployed and executed by exploiting <\/span><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/csa\/cisco-sa-20170629-snmp.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2017-6742<\/span><\/a><span style=\"font-weight: 400;\">,\u00a0 a now patched SNMP (Simple Network Management Protocol) vulnerability. Jaguar Tooth malware targets Cisco IOS and IOS XE routers running firmware C5350-ISM and Version 12.3(6). The malware collects device information, which it then exfiltrates over TFTP (Trivial File Transfer Protocol), allowing unauthenticated backdoor access to the APT 28 operators.\u00a0<\/span><\/p><p><strong>CISA added this vulnerability to the KEV catalog on April 19, 2023, a day after Securin threat intelligence flagged the same. <\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4aed70 elementor-widget elementor-widget-spacer\" data-id=\"d4aed70\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5ae8200 elementor-widget elementor-widget-menu-anchor\" data-id=\"5ae8200\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"Microsoft-SQL-Servers-Hacked-to-Deploy-Trigona-Ransomware\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1435b00 elementor-widget elementor-widget-heading\" data-id=\"1435b00\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Microsoft SQL Servers Hacked to \nDeploy Trigona Ransomware<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e7124a1 elementor-widget elementor-widget-text-editor\" data-id=\"e7124a1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Threat actors are hacking into poorly secured internet-facing Microsoft SQL servers to deploy Trigona ransomware payloads to encrypt all files. Most of the servers were breached via brute-force attacks that took advantage of easy-to-guess account credentials.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Securin experts observed that the Trigona ransomware gang exploits the Zoho ManageEngine ADSelfService Plus vulnerability, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2021-40539\" target=\"_blank\" rel=\"noopener\">CVE-2021-40539<\/a>.\u00a0 <\/span><span style=\"font-weight: 400;\">We recommend security teams to patch the vulnerability as soon as possible to avoid future attacks<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-88568d8 elementor-widget elementor-widget-spacer\" data-id=\"88568d8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1619183 elementor-widget elementor-widget-menu-anchor\" data-id=\"1619183\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"Hacktivist-Threat-Actor-Group-Targets-South-Korea-and-Taiwan\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-081ea51 elementor-widget elementor-widget-heading\" data-id=\"081ea51\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Hacktivist Threat Actor Group Targets South Korea and Taiwan<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-920230b elementor-widget elementor-widget-text-editor\" data-id=\"920230b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Xiaoqiying, a Chinese hacktivist group, has recently launched attacks on South Korean and Taiwanese organizations. The group, also known as Genesis Day, operates on two Telegram channels and has been operational throughout 2022, allegedly gaining unauthorized access to networks in various countries. Through exploiting flaws in internet-connected devices and remote access utilities, the group distributes hacked penetration tools and malware on its channels, indicating an advanced level of cyber risk. They have been exploiting the following vulnerabilities:<\/span><\/p><p><a href=\"https:\/\/security.gentoo.org\/glsa\/202208-34\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-34305<\/span><\/a><span style=\"font-weight: 400;\">: An improper neutralization of input during web page generation (&#8216;Cross-site Scripting&#8217;) vulnerability which affects multiple Apache Tomcat versions.\u00a0<\/span><\/p><p><a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2022-06-01\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-20006<\/span><\/a><span style=\"font-weight: 400;\">: A concurrent execution using shared resources with improper synchronization (&#8216;race condition&#8217;) vulnerability. Affects Android versions 10, 11, 12, and 12.1.\u00a0<\/span><\/p><p><a href=\"https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/netdev\/net.git\/commit\/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-34918<\/span><\/a><span style=\"font-weight: 400;\">: Access of resource using incompatible type (&#8216;type confusion&#8217;) vulnerability. Affects several Linux, Debian, Ubuntu, and NetApp products.\u00a0<\/span><\/p><p><a href=\"https:\/\/www.nginx.com\/blog\/updating-nginx-dns-resolver-vulnerability-cve-2021-23017\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-23017<\/span><\/a><span style=\"font-weight: 400;\">: A Nginx Resolver Off-by-one error which affects Nginix, Fedora, and Oracle products.<\/span><\/p><p><strong>We recommend that organizations look out for these vulnerabilities and patch them immediately.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36afe28 elementor-widget elementor-widget-spacer\" data-id=\"36afe28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0937f84 elementor-widget elementor-widget-heading\" data-id=\"0937f84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d574dff elementor-widget elementor-widget-spacer\" data-id=\"d574dff\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4d590 elementor-widget elementor-widget-menu-anchor\" data-id=\"ba4d590\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2023-2136-Google-Chrome-Zero-Day\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad4baf0 elementor-widget elementor-widget-heading\" data-id=\"ad4baf0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-2136: Google Chrome Zero-Day<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-00ae11d elementor-widget elementor-widget-text-editor\" data-id=\"00ae11d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Google released a security update for the recently discovered Chrome web browser zero-day vulnerability that was found to be exploited in attacks.\u00a0<\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-2136\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-2136<\/span><\/a><span style=\"font-weight: 400;\"> is a high-severity integer overflow vulnerability in Skia, an open-source multi-platform 2D graphics library written in C++ owned by Google. The bug might lead to incorrect rendering, memory corruption or arbitrary code execution leading to unauthorized system access. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77796a7 elementor-widget elementor-widget-spacer\" data-id=\"77796a7\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5918010 elementor-widget elementor-widget-menu-anchor\" data-id=\"5918010\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2023-2033-Chrome-Vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77b0b26 elementor-widget elementor-widget-heading\" data-id=\"77b0b26\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-2033: Chrome Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-744ac7a elementor-widget elementor-widget-text-editor\" data-id=\"744ac7a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-2033\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-2033<\/span><\/a><span style=\"font-weight: 400;\"> is a zero-day exploit in Google Chrome.\u00a0 It is caused by a high-severity type confusion weakness in the Chrome V8 JavaScript engine. An exploit for CVE-2023-2033 exists in the wild. Chrome <\/span><a href=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_14.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">fixed<\/span><\/a><span style=\"font-weight: 400;\"> it in the new version 112.0.5615.121. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d47b516 elementor-widget elementor-widget-spacer\" data-id=\"d47b516\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eef6a9a elementor-widget elementor-widget-menu-anchor\" data-id=\"eef6a9a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2023-25135-vBulletin-Vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dcb4099 elementor-widget elementor-widget-heading\" data-id=\"dcb4099\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">CVE-2023-25135: vBulletin Vulnerability<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-971e64a elementor-widget elementor-widget-text-editor\" data-id=\"971e64a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/github.com\/ambionics\/vbulletin-exploits\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">proof-of-concept<\/span><\/a><span style=\"font-weight: 400;\"> for the exploit of <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-25135\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-25135<\/span><\/a><span style=\"font-weight: 400;\"> has been published. This is a remote code execution vulnerability in vBulletin. It requires authentication for exploitation.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-551aab8 elementor-widget elementor-widget-spacer\" data-id=\"551aab8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3e38b31 elementor-widget elementor-widget-menu-anchor\" data-id=\"3e38b31\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2023-29084-ManageEngine-Vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b359e43 elementor-widget elementor-widget-heading\" data-id=\"b359e43\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">CVE-2023-29084: ManageEngine Vulnerability<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f6632d8 elementor-widget elementor-widget-text-editor\" data-id=\"f6632d8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-29084\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-29084<\/span><\/a><span style=\"font-weight: 400;\"> is a command injection remote code execution vulnerability found in ManageEngine ADManager Plus. It allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ADManager Plus. However, authentication is required to exploit this vulnerability.<\/span><\/p><p><strong>ManageEngine <a href=\"https:\/\/www.manageengine.com\/products\/ad-manager\/admanager-kb\/cve-2023-29084.html\" target=\"_blank\" rel=\"noopener\">fixed<\/a> this vulnerability in its latest update.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3da0499 elementor-widget elementor-widget-spacer\" data-id=\"3da0499\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-be58933 elementor-widget elementor-widget-menu-anchor\" data-id=\"be58933\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"Critical-RCE-bug-in-PaperCut-Servers-Exploited-by-Attackers\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-726be66 elementor-widget elementor-widget-heading\" data-id=\"726be66\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Critical RCE bug in PaperCut Servers Exploited by Attackers<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9bd1f56 elementor-widget elementor-widget-text-editor\" data-id=\"9bd1f56\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>PaperCut, a print management software developer, working with all major brands and platforms, warned its customers about hackers actively exploiting two flaws to gain access to vulnerable servers.\u00a0<\/p><p>The vulnerabilities are yet to get a CVE number and are presently tagged as such:<\/p><ul><li><a href=\"https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-23-233\/\" target=\"_blank\" rel=\"noopener\">ZDI-CAN-18987 \/ PO-1216<\/a>: An unauthenticated remote code execution flaw with a CVSS v3 score of 9.8 (critical) impacting all PaperCut MF and NG versions 8.0 and later on both application and site server OS platforms.<\/li><li><a href=\"https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-23-232\/\" target=\"_blank\" rel=\"noopener\">ZDI-CAN-19226 \/ PO-1219<\/a>: An unauthenticated information disclosure flaw with a CVSS v3 score of 8.2 (high) impacting all PaperCut MF and NG versions 8.0 and later on application OS platforms.<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54fe051 elementor-widget elementor-widget-spacer\" data-id=\"54fe051\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c298c2f elementor-widget elementor-widget-menu-anchor\" data-id=\"c298c2f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CVE-2022-29844-Western-Digital-Vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ec317e1 elementor-widget elementor-widget-heading\" data-id=\"ec317e1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">CVE-2022-29844: Western Digital Vulnerability<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55ff6ab elementor-widget elementor-widget-text-editor\" data-id=\"55ff6ab\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-29844\" target=\"_blank\" rel=\"noopener\">CVE-2022-29844<\/a> is a memory corruption vulnerability impacting the FTP service of the My Cloud Pro Series PR4100. It allows unauthenticated attackers to read and write arbitrary files. This vulnerability could also allow the full compromise of the NAS and give remote command execution capabilities.<\/span><\/p><p><strong>Western Digital patched CVE-2022-29844 in the firmware version<a href=\"https:\/\/www.westerndigital.com\/support\/product-security\/wdc-23002-my-cloud-firmware-version-5-26-119\" target=\"_blank\" rel=\"noopener\"> 5.26.119<\/a>. <\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4c5ea3f elementor-widget elementor-widget-spacer\" data-id=\"4c5ea3f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad293a8 elementor-widget elementor-widget-menu-anchor\" data-id=\"ad293a8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"VMware-vRealize-Vulnerabilities\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1d09ca9 elementor-widget elementor-widget-heading\" data-id=\"1d09ca9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">VMware vRealize Vulnerabilities<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-496cafa elementor-widget elementor-widget-text-editor\" data-id=\"496cafa\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20864\" target=\"_blank\" rel=\"noopener\">CVE-2023-20864<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20865\" target=\"_blank\" rel=\"noopener\">CVE-2023-20865<\/a> are deserialization vulnerabilities in VMware vRealize Log Insight. CVE-2023-20864 can be exploited remotely by unauthenticated threat actors in low-complexity attacks. It doesn\u2019t require user interaction for exploitation. Attackers run arbitrary code as root on compromised systems.<\/span><\/p><p><span style=\"font-weight: 400;\">CVE-2023-20865 enables remote attackers with administrative privileges to execute arbitrary commands as root.<\/span><\/p><p><strong>VMware <a href=\"https:\/\/kb.vmware.com\/s\/article\/91831\" target=\"_blank\" rel=\"noopener\">fixed<\/a> both the vulnerabilities and urged users to patch them immediately.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c3359d elementor-widget elementor-widget-spacer\" data-id=\"9c3359d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5661ac2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5661ac2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12cd24e\" data-id=\"12cd24e\" data-element_type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a79af4 elementor-widget elementor-widget-spacer\" data-id=\"6a79af4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8edd1c elementor-widget elementor-widget-text-editor\" data-id=\"f8edd1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #000000;\">Follow our weekly blog and podcast to get proactive alerts on trending threats.<\/span><\/strong><\/p><p style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers. <\/strong><a href=\"\/contact-us\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Talk to Us!<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b9a97 elementor-widget elementor-widget-spacer\" data-id=\"56b9a97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[478,544,89,649,116,651,647,646,648,650,643,652,108],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17666"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=17666"}],"version-history":[{"count":36,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17666\/revisions"}],"predecessor-version":[{"id":17980,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17666\/revisions\/17980"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=17666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=17666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=17666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}