Neueste Nachrichten zu Sicherheitslücken

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services - Client
1009717 - Microsoft Windows PowerShell ISE Filename Parsing Remote Code Execution Vulnerability Over SMB


Hot Rod Client
1009119 - Red Hat JBoss Data Grid Hot Rod Client Insecure Deserialization (CVE-2017-15089)


Web Application Common
1009700* - Ghostscript Denial Of Service Vulnerability (CVE-2017-9835) - 1
1009315* - ImageMagick 'SetGrayscaleImage' Heap Overflow Vulnerability (CVE-2018-11625) - 1
1009352* - Libxml2 Null Pointer Dereference Vulnerability (CVE-2018-14404) - 1


Web Client Common
1009392 - Microsoft Windows MS XML Remote Code Execution Vulnerability (CVE-2018-8494)
1009714 - Microsoft Windows PowerShell ISE Filename Parsing Remote Code Execution Vulnerability


Web Server Adobe ColdFusion
1009455 - Adobe ColdFusion CKEditor 'upload.cfm' Directory Traversal Vulnerability (CVE-2018-15960)


Web Server Common
1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)


Web Server SAP
1009715 - SAP Gateway 'gw/acl_mode' Command Injection Vulnerability


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Web Application Common
1009728 - Jenkins Stapler Web Framework Remote Code Execution Vulnerability (CVE-2018-1000861)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Web Application Common
1009728* - Jenkins Stapler Web Framework Remote Code Execution Vulnerability (CVE-2018-1000861)
1009467* - Microsoft Exchange Server NTLM Reflection EWS Authentication Bypass Vulnerability (CVE-2018-8581)


Web Application PHP Based
1009481* - Drupal Core Critical Arbitrary PHP Code Execution Vulnerability (CVE-2019-6339)


Web Client Common
1009740 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 1
1009735 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 2
1009738 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 3
1009736 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 4
1009742 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 5
1009739 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 6
1009737 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 7
1009741 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 8
1009734 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-18) - 9
1009732 - Adobe Flash Player Use After Free Vulnerability (CVE-2019-7837)
1009722 - Microsoft Windows Error Reporting Elevation Of Privilege Vulnerability (CVE-2019-0863)
1009723 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0882)
1009725 - Microsoft Windows OLE Remote Code Execution Vulnerability (CVE-2019-0885)
1009743 - Oracle Java Runtime Environment 'sc_FindExtrema4' Heap Corruption Vulnerability (CVE-2019-2697)
1009744 - Oracle Java Runtime Environment 'setCurrGlyphID' Heap Corruption Vulnerability (CVE-2019-2698)


Web Client Internet Explorer/Edge
1009731 - Microsoft Edge Elevation Of Privilege Vulnerability (CVE-2019-0938)
1009729 - Microsoft Edge Memory Corruption Vulnerability (CVE-2019-0926)
1009724 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0884)
1009726 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0911)
1009733 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0940)
1009730 - Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2019-0930)
1009727 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0918)


Web Server Adobe ColdFusion
1009455* - Adobe ColdFusion CKEditor 'upload.cfm' Directory Traversal Vulnerability (CVE-2018-15960)
1009387* - Adobe ColdFusion Remote File Upload Vulnerability (CVE-2018-15961)


Integrity Monitoring Rules:

1009710 - Install Root Certificate (ATT&CK: T1130)
1008257* - Microsoft Windows - USB Storage Device Detected (ATT&CK: T1092)
1009670 - Service Registry Permissions Weakness (ATT&CK: T1058)


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DHCP Client - Incoming
1009718 - Microsoft Windows DHCP Client Remote Code Execution Vulnerability (CVE-2019-0697)


Mail Server Exim
1009747 - MailCarrier Remote Code Execution Vulnerability (CVE-2004-1638)


Web Application Common
1009423* - ImageMagick Multiple Security Vulnerabilities (Server) - 26
1009057* - Pivotal Spring Data Commons Remote Code Execution Vulnerability (CVE-2018-1273)


Web Application PHP Based
1009720 - Drupal Core Cross-Site Scripting Vulnerability (CVE-2019-6341)
1009541* - Drupal Core Remote Code Execution Vulnerability (CVE-2019-6340)


Web Client Common
1009291 - Foxit Reader Multiple Security Vulnerabilities - 10
1009716 - Google Chrome 'NewFixedDoubleArray' Integer Overflow Vulnerability
1009709 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0802)
1009297 - Oracle Java SE and Java for Business 'XNewPtr()' Remote Code Execution Vulnerability (CVE-2010-0843)


Web Client Internet Explorer/Edge
1009449* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8653)


Web Server IIS
1009346 - Microsoft IIS MDAC 'msadcs.dll' RDS DataStub Content-Type Heap Overflow Vulnerability (CVE-2002-1142)


Web Server Miscellaneous
1004750* - Oracle Java RMI Server Insecure Default Configuration Java Code Execution


Web Server Oracle
1009225* - Oracle WebLogic Server WLS Web Services Remote Code Execution Vulnerability (CVE-2018-2894)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DHCP Client
1009476 - Microsoft Windows DHCP Client Remote Code Execution Vulnerability (CVE-2019-0547)


HP Intelligent Management Center (IMC)
1009799 - HPE Intelligent Management Center 'AccessMgrServlet ClassName' Insecure Deserialization (CVE-2019-11945)


Web Application Common
1000608* - Generic SQL Injection Prevention


Web Client Common
1009829 - Microsoft Windows Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-0908)
1009770 - OpenOffice Information Disclosure Vulnerability (CVE-2018-10583)
1009762 - mIRC Remote Command Execution Vulnerability (CVE-2019-6453)


Web Client Internet Explorer/Edge
1009655* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0752)


Web Client Mozilla Firefox
1009828 - Mozilla Firefox Type Confusion Vulnerability (CVE-2019-11707)


Web Client VNC
1009494 - LibVNC LibVNCClient CoRRE Heap-based Buffer Overflow Vulnerability (CVE-2018-20020)


Web Server Common
1000763* - URI Length Restriction


Web Server Miscellaneous
1008104* - Apache ActiveMQ Multiple Remote Code Execution Vulnerabilities (CVE-2016-3088)


Web Server RealVNC
1004146* - RealVNC 'ClientCutText' Message Memory Corruption


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

An insecure method in the ARDoc ActiveX Control (ARDoc.dll) can be exploited to overwrite arbitrary files with the contents of exported documents via a call to the "SaveToFile()" method with a specially crafted "bstrFileName" argument. Successful exploitation of this vulnerability allows execution of arbitrary code.

Quest InTrust is prone to a remote code-execution vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1011587 - Microsoft Windows Server Service Tampering Vulnerability (CVE-2022-30216)


JBoss Remoting Connector Unified Invoker
1011570* - Red Hat JBoss Enterprise Application Platform Remote Code Execution Vulnerability


SolarWinds Information Service
1011586 - SolarWinds Network Performance Monitor 'DeserializeFromStrippedXml' Insecure Deserialization Vulnerability (CVE-2022-36958)


WSO2 Enterprise Integrator
1011580* - WSO2 Enterprise Integrator Cross-Site Scripting Vulnerability (CVE-2022-39810)


Web Application Common
1011588 - Dolibarr ERP And CRM Code Injection Vulnerability (CVE-2022-40871)
1011577* - Fastify Denial Of Service Vulnerability (CVE-2022-39288)
1007170* - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1505.003)


Web Application PHP Based
1011574* - WordPress 'Ketchup Restaurant Reservations' Plugin Cross-Site Scripting Vulnerability (CVE-2022-2753)
1011579* - WordPress 'Litespeed' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29172)
1011584 - WordPress 'WP Super Cache' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24329)
1011582 - WordPress 'WPvivid Backup' Plugin Directory Traversal Vulnerability (CVE-2022-2863)


Web Server Miscellaneous
1011581* - Apache JSPWiki 'UserPreferences.jsp' Cross-Site Request Forgery Vulnerability (CVE-2022-28731)
1011572* - Vm2 Sandbox Remote Code Execution Vulnerability (CVE-2021-23449)
1011583 - XWiki Code Injection Vulnerability (CVE-2022-36100)
1011569 - XWiki Cross-Site Scripting Vulnerability (CVE-2022-36094)
1011578 - XWiki Cross-Site Scripting Vulnerability (CVE-2022-36096)


Zoho ManageEngine
1011549* - Zoho ManageEngine Multiple Products SQL Injection Vulnerability (CVE-2022-40300)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1011453* - Microsoft Windows WMI Events - 1

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Apache Storm Nimbus
1011236* - Apache Storm Command Injection Vulnerability (CVE-2021-38294)


Directory Server LDAP
1011246 - Microsoft Windows Active Directory Domain Services Elevation of Privilege Vulnerability Over LDAP (CVE-2021-42278)


SolarWinds Network Performance Monitor
1011229* - SolarWinds Orion Patch Manager Insecure Deserialization Vulnerability (CVE-2021-35216)
1011221* - SolarWinds Orion Platform 'SaveUserSetting' Improper Access Control Vulnerability (CVE-2021-35213)
1011230 - SolarWinds Patch Manager 'WSAsyncExecuteTasks' Deserialization Vulnerability (CVE-2021-35217)


Web Application Common
1010423* - Primetek Primefaces Remote Code Execution Vulnerability (CVE-2017-1000486)
1011198 - Strapi Framework Remote Code Execution Vulnerability (CVE-2019-19609)


Web Server Common
1011249* - Apache Log4j Denial of Service Vulnerability (CVE-2021-45105)
1008581* - Identified Suspicious IP Addresses In XFF HTTP Header


Web Server HTTPS
1011232* - Montala Limited ResourceSpace Arbitrary File Deletion Vulnerability (CVE-2021-41950)


Web Server SharePoint
1011224* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-41344)


Web Server Squid
1011234* - Squid Proxy Multiple Denial of Service Vulnerabilities (CVE-2021-31806 and CVE-2021-31807)


Windows SMB Server
1011251 - Microsoft Windows Active Directory Domain Services Elevation of Privilege Vulnerability Over SMB (CVE-2021-42278)


Zoho ManageEngine
1011237* - Zoho ManageEngine ADManager Plus Unrestricted File Upload Vulnerability (CVE-2021-20130)
1011248 - Zoho ManageEngine ADManager Plus Unrestricted File Upload Vulnerability (CVE-2021-37539)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1011250 - Web Server - Apache - 2

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)


Memcached
1011098* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)


Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)


Web Application PHP Based
1011193 - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)


Web Client Common
1010806* - Identified Directory Traversal Attack In HTTP Response Headers
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)


Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)


Web Server HTTPS
1011196 - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190 - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)


Web Server Nagios
1011191* - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)


Zoho ManageEngine
1011188* - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)


Zoho ManageEngine ADSelfService Plus
1011194 - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)