VULNERA Pulse

IETF — Service Location Protocol (SLP)

CVE-2023-29552 / Added: Nov. 8, 2023

HIGH CVSS 7.50 EPSS Score 16.32 EPSS Percentile 95.45

The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.

Headlines

• Nov. 9, 2023 - CISA adds SLP flaw to its Known Exploited Vulnerabilities catalog
• Nov. 9, 2023 - CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild
• Nov. 9, 2023 - CISA Alerts: High-Severity SLP Vulnerability Now Under Active Exploitation
• Nov. 8, 2023 - CVE-2023-29552: CISA Warns of Actively Exploited SLP Vulnerability
• April 30, 2023 - newsletter Round 417 by Pierluigi Paganini – International edition
• April 26, 2023 - High-Severity SLP Flaw Can Amplify DDoS Attacks up to 2,200 Times
• April 26, 2023 - SLP Vulnerability Allows DoS Attacks With Amplification Factor of 2,200
• April 26, 2023 - New SLP Vulnerability Could Enable Massive DDoS Attacks
• April 26, 2023 - Old protocol has new DoS-amplification bug
• April 25, 2023 - New DDoS amplification vector could enable massive attacks
• April 25, 2023 - SLP flaw allows DDoS attacks with an amplification factor as high as 2200 times
• April 25, 2023 - New SLP bug can lead to massive 2,200x DDoS amplification attacks
• April 25, 2023 - New SLP Vulnerability Could Let Attackers Launch 2200x Powerful DDoS Attacks
• April 25, 2023 - Abuse of the Service Location Protocol May Lead to DoS Attacks | CISA

Back to top ↑

Atlassian — Confluence Data Center and Server

CVE-2023-22518 / Added: Nov. 7, 2023

CRITICAL CVSS 9.80 EPSS Score 96.76 EPSS Percentile 99.57

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

Headlines

• Nov. 10, 2023 - Cerber Ransomware Targets Confluence Servers, Organizations Urged to Patch
• Nov. 10, 2023 - Alert: 'Effluence' Backdoor Persists Despite Patching Atlassian Confluence Servers
• Nov. 10, 2023 - November 2023 Patch Tuesday forecast: Year 21 begins
• Nov. 9, 2023 - A new video series, Google Forms spam and the various gray areas of cyber attacks
• Nov. 8, 2023 - Confluence flaw severity raised amid mass exploitation
• Nov. 8, 2023 - Confluence vulnerabilities under active ransomware exploitation
• Nov. 7, 2023 - Atlassian Bug Escalated to 10, All Unpatched Instances Vulnerable
• Nov. 7, 2023 - CISA Warns of Actively Exploited Atlassian Confluence Security Flaw
• Nov. 7, 2023 - Confluence to Cerber: Exploitation of ​​CVE-2023-22518 for Ransomware Deployment
• Nov. 7, 2023 - Critical Atlassian Bug Exploited in Ransomware Attacks
• Nov. 7, 2023 - Experts Warn of Ransomware Hackers Exploiting Atlassian and Apache Flaws
• Nov. 6, 2023 - Critical Confluence flaw exploited in ransomware attacks
• Nov. 6, 2023 - Critical Atlassian Confluence bug exploited in Cerber ransomware attacks
• Nov. 6, 2023 - Exploitation of Critical Confluence Vulnerability Begins
• Nov. 6, 2023 - Atlassian Confluence data-wiping vulnerability exploited
• Nov. 5, 2023 - Week in review: Exploited Citrix Bleed vulnerability, Atlassian patches critical Confluence bug
• Nov. 3, 2023 - Critical Atlassian Bug Exploit Now Available; Immediate Patching Needed
• Nov. 3, 2023 - Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw
• Nov. 3, 2023 - Atlassian Finds Public Exploit for Critical Bug
• Nov. 2, 2023 - Atlassian warns of exploit for Confluence data wiping bug, get patching
• Nov. 2, 2023 - Atlassian Releases Security Advisory for Confluence Data Center and Server | CISA
• Nov. 1, 2023 - Atlassian Customers Should Patch Latest Critical Vuln Immediately
• Oct. 31, 2023 - Critical vulnerability found in Atlassian Confluence software
• Oct. 31, 2023 - Critical Atlassian Confluence flaw can lead to significant data loss
• Oct. 31, 2023 - Atlassian warns of critical Confluence flaw leading to data loss
• Oct. 31, 2023 - Atlassian CISO Urges Quick Action to Protect Confluence Instances From Critical Vulnerability
• Oct. 31, 2023 - Atlassian Warns of New Critical Confluence Vulnerability Threatening Data Loss
• Oct. 31, 2023 - Atlassian patches critical Confluence bug, urges for immediate action (CVE-2023-22518)
• Oct. 31, 2023 - CVE-2023-22518: A Critical Vulnerability in Atlassian Confluence
• Oct. 31, 2023 - Atlassian warns users: patch critical Confluence flaw ASAP

Back to top ↑

CVE-2023-38547

CRITICAL CVSS 9.90 EPSS Score 0.04 EPSS Percentile 12.90

Remote Code Execution

Published: Nov. 7, 2023

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.

Quotes

• Allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database
• A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database

Headlines

• Nov. 9, 2023 - Veeam patches ONE monitoring platform
• Nov. 7, 2023 - Critical Vulnerabilities Expose Veeam ONE Software to Code Execution
• Nov. 7, 2023 - Veeam fixed multiple flaws in Veeam ONE, including critical issues
• Nov. 7, 2023 - Veeam Patches Two Critical Bugs in Veeam ONE
• Nov. 7, 2023 - Critical Flaws Discovered in Veeam ONE IT Monitoring Software – Patch Now

CVE-2023-22518

CRITICAL CVSS 9.80 EPSS Score 96.76 EPSS Percentile 99.57

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 31, 2023

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Vendor Impacted: Atlassian

Products Impacted: Confluence Data Center And Server, Confluence Data Center, Confluence Server

Quotes

• Change in the scope of the attack
• Due to a change in scope of the attack
• Critical information about the vulnerability
• If it seems too good to be true, it probably is
• The threat landscape is as unforgiving as it is unpredictable
• Significant data loss if exploited by an unauthenticated attacker
• Several active exploits and reports of threat actors using ransomware
• Possible mass exploitation of vulnerable internet-facing Atlassian Confluence servers
• The malware acts as a persistent backdoor and is not remediated by applying patches to Confluence
• After the initial enumeration activity, the adversary executed Base64 commands to spawn follow-on commands via python2 or python3
• Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch
• As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker
• An AI assistant for security teams that builds on the latest in large language models and harnesses Microsoft’s security expertise and global threat intelligence to help security teams outpace their adversaries

Headlines

• Nov. 10, 2023 - Cerber Ransomware Targets Confluence Servers, Organizations Urged to Patch
• Nov. 10, 2023 - Alert: 'Effluence' Backdoor Persists Despite Patching Atlassian Confluence Servers
• Nov. 10, 2023 - November 2023 Patch Tuesday forecast: Year 21 begins
• Nov. 9, 2023 - A new video series, Google Forms spam and the various gray areas of cyber attacks
• Nov. 8, 2023 - Confluence flaw severity raised amid mass exploitation
• Nov. 8, 2023 - Confluence vulnerabilities under active ransomware exploitation
• Nov. 7, 2023 - Atlassian Bug Escalated to 10, All Unpatched Instances Vulnerable
• Nov. 7, 2023 - CISA Warns of Actively Exploited Atlassian Confluence Security Flaw
• Nov. 7, 2023 - Confluence to Cerber: Exploitation of ​​CVE-2023-22518 for Ransomware Deployment
• Nov. 7, 2023 - Critical Atlassian Bug Exploited in Ransomware Attacks
• Nov. 7, 2023 - Experts Warn of Ransomware Hackers Exploiting Atlassian and Apache Flaws
• Nov. 6, 2023 - Critical Confluence flaw exploited in ransomware attacks
• Nov. 6, 2023 - Critical Atlassian Confluence bug exploited in Cerber ransomware attacks
• Nov. 6, 2023 - Exploitation of Critical Confluence Vulnerability Begins
• Nov. 6, 2023 - Atlassian Confluence data-wiping vulnerability exploited
• Nov. 5, 2023 - Week in review: Exploited Citrix Bleed vulnerability, Atlassian patches critical Confluence bug

CVE-2023-22515

CRITICAL CVSS 9.80 EPSS Score 95.53 EPSS Percentile 99.21

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 4, 2023

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Vendor Impacted: Atlassian

Products Impacted: Confluence Data Center And Server, Confluence Data Center, Confluence Server

Quotes

• Change in the scope of the attack
• The threat landscape is as unforgiving as it is unpredictable
• Several active exploits and reports of threat actors using ransomware
• The malware acts as a persistent backdoor and is not remediated by applying patches to Confluence
• After the initial enumeration activity, the adversary executed Base64 commands to spawn follow-on commands via python2 or python3
• As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker
• An AI assistant for security teams that builds on the latest in large language models and harnesses Microsoft’s security expertise and global threat intelligence to help security teams outpace their adversaries

Headlines

• Nov. 10, 2023 - Alert: 'Effluence' Backdoor Persists Despite Patching Atlassian Confluence Servers
• Nov. 10, 2023 - November 2023 Patch Tuesday forecast: Year 21 begins
• Nov. 8, 2023 - Confluence flaw severity raised amid mass exploitation
• Nov. 7, 2023 - CISA Warns of Actively Exploited Atlassian Confluence Security Flaw
• Nov. 7, 2023 - Critical Atlassian Bug Exploited in Ransomware Attacks
• Nov. 7, 2023 - Experts Warn of Ransomware Hackers Exploiting Atlassian and Apache Flaws
• Nov. 6, 2023 - Critical Atlassian Confluence bug exploited in Cerber ransomware attacks

CVE-2017-9841

CRITICAL CVSS 9.80 EPSS Score 97.48 EPSS Percentile 99.97

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: June 27, 2017

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "

Vendors Impacted: Phpunit Project, Phpunit, Oracle

Products Impacted: Communications Diameter Signaling Router, Phpunit

Quotes

• We have uncovered the threat actor's manual efforts to [carry out attacks]
• From what we know, this is the first time Kinsing has tried to collect this kind of information
• Utilizing a rudimentary yet typical PHPUnit vulnerability exploit attack, a component of Kinsing's ongoing campaign, we have uncovered the threat actor's manual efforts to manipulate the Looney Tunables vulnerability
• Typically, Kinsing engages in fully automated attacks with the primary objective of mining cryptocurrency. However, in this recent discovery, we observed Kinsing conducting manual tests, a deviation from their usual modus operandi
• A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges

Headlines

• Nov. 7, 2023 - Looney Tunables bug exploited for cryptojacking
• Nov. 7, 2023 - Kinsing Threat Actor Targets Linux Flaw for Cloud Environment Breaches
• Nov. 6, 2023 - Kinsing Cyberattackers Debut 'Looney Tunables' Cloud Exploits
• Nov. 6, 2023 - Hackers exploit Looney Tunables Linux bug, steal cloud creds
• Nov. 6, 2023 - 'Looney Tunables' Glibc Vulnerability Exploited in Cloud Attacks
• Nov. 4, 2023 - Kinsing threat actors probed the Looney Tunables flaws

CVE-2023-38548

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 7.34

Risk Context N/A

Published: Nov. 7, 2023

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.

Quotes

• Allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database
• A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database

Headlines

• Nov. 9, 2023 - Veeam patches ONE monitoring platform
• Nov. 7, 2023 - Critical Vulnerabilities Expose Veeam ONE Software to Code Execution
• Nov. 7, 2023 - Veeam fixed multiple flaws in Veeam ONE, including critical issues
• Nov. 7, 2023 - Veeam Patches Two Critical Bugs in Veeam ONE
• Nov. 7, 2023 - Critical Flaws Discovered in Veeam ONE IT Monitoring Software – Patch Now

CVE-2023-4911

HIGH CVSS 7.80 EPSS Score 0.18 EPSS Percentile 55.27

Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 3, 2023

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Vendors Impacted: Redhat, Gnu, Fedoraproject

Products Impacted: Fedora, Virtualization, Glibc, Enterprise Linux

Quotes

• We have uncovered the threat actor's manual efforts to [carry out attacks]
• From what we know, this is the first time Kinsing has tried to collect this kind of information
• Utilizing a rudimentary yet typical PHPUnit vulnerability exploit attack, a component of Kinsing's ongoing campaign, we have uncovered the threat actor's manual efforts to manipulate the Looney Tunables vulnerability
• Typically, Kinsing engages in fully automated attacks with the primary objective of mining cryptocurrency. However, in this recent discovery, we observed Kinsing conducting manual tests, a deviation from their usual modus operandi
• A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges

Headlines

• Nov. 7, 2023 - Looney Tunables bug exploited for cryptojacking
• Nov. 7, 2023 - Kinsing Threat Actor Targets Linux Flaw for Cloud Environment Breaches
• Nov. 6, 2023 - Kinsing Cyberattackers Debut 'Looney Tunables' Cloud Exploits
• Nov. 6, 2023 - Hackers exploit Looney Tunables Linux bug, steal cloud creds
• Nov. 6, 2023 - 'Looney Tunables' Glibc Vulnerability Exploited in Cloud Attacks
• Nov. 4, 2023 - Kinsing threat actors probed the Looney Tunables flaws

CVE-2023-4966

HIGH CVSS 7.50 EPSS Score 92.27 EPSS Percentile 98.69

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server. 

Vendor Impacted: Citrix

Products Impacted: Netscaler Gateway, Netscaler Application Delivery Controller, Netscaler Adc And Netscaler Gateway

Quotes

• Significant data loss if exploited by an unauthenticated attacker
• The Securities Industry and Financial Markets Association first told members on Wednesday that ICBC Financial Services had been hit by ransomware software, which paralyses computer systems unless a payment is made, several people familiar with the discussions said
• On November 8, 2023, U.S. Eastern Time (November 9, 2023, Beijing Time), ICBC Financial Services (FS) experienced a ransomware attack that resulted in disruption to certain FS systems. Immediately upon discovering the incident, ICBC FS disconnected and isolated impacted systems to contain the incident

Headlines

• Nov. 10, 2023 - World's biggest bank hit by ransomware, forced to trade via USB stick
• Nov. 10, 2023 - Chinese multinational bank hit by ransomware
• Nov. 10, 2023 - Industrial and Commercial Bank of China (ICBC) suffered a ransomware attack
• Nov. 10, 2023 - ICBC hit by ransomware impacting global trades
• Nov. 7, 2023 - CISA Releases Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix Bleed | CISA
• Nov. 5, 2023 - Week in review: Exploited Citrix Bleed vulnerability, Atlassian patches critical Confluence bug

CVE-2023-29552

HIGH CVSS 7.50 EPSS Score 16.32 EPSS Percentile 95.45

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: April 25, 2023

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

Vendors Impacted: Ietf, Service Location Protocol Project, Netapp, Vmware, Suse

Products Impacted: Service Location Protocol (Slp), Manager Server, Smi-S Provider, Linux Enterprise Server, Service Location Protocol, Esxi

Quotes

• The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor
• To protect against CVE-2023-29552, SLP should be disabled on all systems running on untrusted networks, like those directly connected to the Internet. If that is not possible, then firewalls should be configured to filter traffic on UDP and TCP port 427. This will prevent external attackers from accessing the SLP service

Headlines

• Nov. 9, 2023 - CISA adds SLP flaw to its Known Exploited Vulnerabilities catalog
• Nov. 9, 2023 - CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild
• Nov. 9, 2023 - CISA Alerts: High-Severity SLP Vulnerability Now Under Active Exploitation
• Nov. 8, 2023 - CVE-2023-29552: CISA Warns of Actively Exploited SLP Vulnerability

CVE-2023-41723

MEDIUM CVSS 4.30 EPSS Score 0.04 EPSS Percentile 7.34

Risk Context N/A

Published: Nov. 7, 2023

A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.

Quotes

• Allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database
• A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database

Headlines

• Nov. 9, 2023 - Veeam patches ONE monitoring platform
• Nov. 7, 2023 - Critical Vulnerabilities Expose Veeam ONE Software to Code Execution
• Nov. 7, 2023 - Veeam fixed multiple flaws in Veeam ONE, including critical issues
• Nov. 7, 2023 - Veeam Patches Two Critical Bugs in Veeam ONE
• Nov. 7, 2023 - Critical Flaws Discovered in Veeam ONE IT Monitoring Software – Patch Now