VULNERA Pulse

Microsoft — Windows

CVE-2022-41049 / Added: Nov. 14, 2022

MEDIUM CVSS 5.40

Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

Back to top ↑

CVE-2022-43782

CRITICAL CVSS 9.80

Risk Context N/A

Published: Nov. 17, 2022

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3

Quotes

• There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to gain code execution and execute code on the system - Security Affairs

Headlines

• Nov. 18, 2022 - Atlassian fixed 2 critical flaws in Crowd and Bitbucket products
• Nov. 18, 2022 - Atlassian Patches Critical Vulnerabilities in Bitbucket, Crowd

CVE-2022-43781

CRITICAL CVSS 9.80

Risk Context N/A

Published: Nov. 17, 2022

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Vendor Impacted: Atlassian

Product Impacted: Bitbucket

Quotes

• There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to gain code execution and execute code on the system - Security Affairs

Headlines

• Nov. 18, 2022 - Atlassian fixed 2 critical flaws in Crowd and Bitbucket products
• Nov. 18, 2022 - Atlassian Patches Critical Vulnerabilities in Bitbucket, Crowd

CVE-2022-20465

MEDIUM CVSS 4.60

Risk Context N/A

Published: Nov. 8, 2022

In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-218500036

Vendor Impacted: Google

Product Impacted: Android

Quotes

• The joint standing operation will not simply respond to crimes as they affect Australians; they will be hunting these gangs around the world and disrupting the actives of these people - Cisco Talos Blog

Headlines

• Nov. 17, 2022 - Threat Source newsletter (Nov. 17, 2022): Hot off the press! The Snort 2023 Calendar is here
• Nov. 15, 2022 - Google pays researcher $70,000 for discovering simple Android lock screen bypass bug
• Nov. 15, 2022 - Beware! This bug could allow anyone to unlock your Android phone without password, fingerprint - Economic Times
• Nov. 14, 2022 - This Google Pixel bug fix could have spelled trouble for all Android phones
• Nov. 14, 2022 - A Simple Android Lock Screen Bypass Bug Landed a Researcher $70,000
• Nov. 14, 2022 - A simple Android lock screen bypass bug landed a researcher $70,000 - TechCrunch
• Nov. 14, 2022 - Millions of Android owners warned anyone can bypass your lock screen – update your phone now... - The Sun

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Headlines

• Nov. 18, 2022 - IT threat evolution in Q3 2022. Non-mobile statistics
• Nov. 15, 2022 - What are Dating Apps Doing to Protect Their Users?

CVE-2022-36067

CRITICAL CVSS 10.00

Remote Code Execution Public Exploits Available

Published: Sept. 6, 2022

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Quotes

• An unauthenticated threat actor can execute arbitrary system commands on a Backstage application by exploiting a vm2 sandbox escape in the Scaffolder core plugin - Security Affairs
• There's a hole in my ${BUCKET}, dear Liza, dear Liza, there's a hole in my ${BUCKET}, dear Liza. A hole! - Naked Security - Sophos
• An unauthenticated threat actor can execute arbitrary system commands on a Backstage application by exploiting a vm2 sandbox escape in the Scaffolder core plugin - The Hacker News
• Backstage can hold integration details to many organization systems, such as Prometheus, Jira, ElasticSearch, and others. Thus, successful exploitation has critical implications for any affected organization and can compromise those services and the data they hold - SecurityWeek

Headlines

• Nov. 15, 2022 - Experts found critical RCE in Spotify’s Backstage
• Nov. 15, 2022 - Log4Shell-like code execution hole in popular Backstage dev tool
• Nov. 15, 2022 - Critical RCE Flaw Reported in Spotify's Backstage Software Catalog and Developer Platform
• Nov. 15, 2022 - Organizations Warned of Critical Vulnerability in Backstage Developer Portal Platform

CVE-2021-44228

CRITICAL CVSS 10.00

CISA Known Exploited Actively Exploited Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Percussion, Cisco, Netapp, Snowsoftware, Siemens, Bentley, Intel, Apache

Products Impacted: Log4j, Paging Server, Unified Communications Manager Im An, Crosswork Network Controller, Crosswork Optimization Engine, Iot Operations Dashboard, Workload Optimization Manager, Connected Mobile Experiences, Dna Spaces Connector, Mobility Services Engine, Virtualized Infrastructure Manager, Snapcenter, Common Services Platform Collector, Contact Center Management Portal, Ucs Central, Synchro 4d, Broadworks, Log4j2, Integrated Management Controller Sup, Vm Access Proxy, Cloud Connect, Automated Subsea Tuning, Business Process Automation, Virtual Topology System, Virtualized Voice Browser, Cloudcenter Suite, Optical Network Controller, Cloudcenter, Cloudcenter Suite Admin, Rhythmyx, Unity Connection, Identity Services Engine, Ontap Tools, Data Center Manager, Nexus Dashboard, Crosswork Zero Touch Provisioning, Unified Sip Proxy, Cx Cloud Agent, Enterprise Chat And Email, Unified Contact Center Management Po, Video Surveillance Manager, Unified Customer Voice Portal, Fog Director, Ucs Director, Network Insights For Data Center, Finesse, Wan Automation Engine, Cyber Vision Sensor Management Exten, Ucs Central Software, Evolved Programmable Network Manager, Crosswork Data Gateway, Advanced Malware Protection Virtual , Unified Contact Center Enterprise, Nexus Insights, Unified Communications Manager, Unified Contact Center Express, Data Center Network Manager, Intersight Virtual Appliance, Oneapi Sample Browser, Crosswork Network Automation, Crosswork Platform Infrastructure, Unified Intelligence Center, Fxos, Prime Service Catalog, Synchro, Sppa-T3000 Ses3000 Firmware, Unified Workforce Optimization, Webex Meetings Server, Connected Analytics For Network Depl, Smart Phy, Cloudcenter Workload Manager, Network Assurance Engine, Snow Commander, Sppa-T3000 Ses3000, Packaged Contact Center Enterprise, Dna Spaces, Emergency Responder, Unified Computing System, Sd-Wan Vmanage, Cloudcenter Cost Optimizer, Unified Communications Manager Im \&, Network Dashboard Fabric Controller, Cyber Vision, Network Services Orchestrator, Customer Experience Cloud Agent, Dna Center, Firepower Threat Defense, Dna Spaces\, Video Surveillance Operations Manage, Contact Center Domain Manager

Quotes

• CISA obtained four malicious files for analysis during an on-site incident response engagement at a Federal Civilian Executive Branch (FCEB) organization compromised by Iranian government sponsored advanced persistent threat (APT) actors - Security Affairs
• Cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence - The Hacker News

Headlines

• Nov. 18, 2022 - IT threat evolution in Q3 2022. Non-mobile statistics
• Nov. 17, 2022 - Not patched Log4j yet? Assume attackers are in your network, say CISA and FBI
• Nov. 17, 2022 - Iran-linked threat actors compromise US Federal Network
• Nov. 17, 2022 - Iranian Hackers Compromised a U.S. Federal Agency’s Network Using Log4Shell Exploit
• Nov. 17, 2022 - Iranian Hackers Breached Federal Agency Using Log4Shell Exploit
• Nov. 16, 2022 - Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

CVE-2020-12812

CRITICAL CVSS 9.80

CISA Known Exploited Used In Ransomware

Published: July 24, 2020

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Vendor Impacted: Fortinet

Product Impacted: Fortios

Quotes

• Hive actors have been known to reinfect - with either Hive ransomware or another ransomware variant - the networks of victim organizations who have restored their network without making a ransom payment - The Register - Security
• As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments - Security Affairs
• Once the victim organization contacts Hive actors on the live chat panel, Hive actors communicate the ransom amount and the payment deadline. Hive actors negotiate ransom demands in US dollars, with initial amounts ranging from several thousand to millions of dollars. Hive actors demand payment in Bitcoin - SecurityWeek
• Hive actors have gained initial access to victim networks by using single-factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs) and other remote network connection protocols - infosecurity-magazine.com

Headlines

• Nov. 18, 2022 - Hive ransomware crooks extort $100m from 1,300 global victims
• Nov. 18, 2022 - Hive Ransomware extorted over $100M in ransom payments from over 1,300 companies
• Nov. 18, 2022 - Hive Ransomware Gang Hits 1,300 Businesses, Makes $100 Million
• Nov. 18, 2022 - Hive Ransomware Has Made $100m to Date

CVE-2017-11882

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Nov. 15, 2017

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

Vendor Impacted: Microsoft

Product Impacted: Office

Quotes

• Read and change all your data on the websites you visit - Securelist
• At the end of Q3 their 'builder' was released, and allegedly various groups are already establishing their own RaaS with it - infosecurity-magazine.com

Headlines

• Nov. 18, 2022 - IT threat evolution Q3 2022
• Nov. 18, 2022 - Transportation sector targeted by both ransomware and APTs
• Nov. 16, 2022 - LockBit Remains Most Prolific Ransomware in Q3
• Nov. 16, 2022 - Ransomware Activity Doubles in Transportation and Shipping Industry