opsecsafe — cyber intelligence

2023-07-14

2023-07-14 00:00Z

HIGH

The DPRK strikes using a new variant of RUSTBUCKET

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed a new variant of RUSTBUCKET malware attributed to North Korean Lazarus Group (BlueNorOff), targeting macOS systems at cryptocurrency service providers. The variant adds previously unseen LaunchAgent persistence, employs multi-stage execution via AppleScript/Swift/Rust binaries, and uses User-Agent string validation and rapid C2 domain rotation to evade detection. At publication, the variant had zero VirusTotal detections and was actively used in intrusions against a US-based cryptocurrency payment services company.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0007TACTA0003OSMacosVNDElastic

Edit Score

2023-07-13

2023-07-13 14:15Z

CRIT

CVE-2023-35070 — Vegagroup Web_collection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35070

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDVegagroupTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-13

2023-07-13 08:15Z

CRIT

CVE-2023-2957 — Lisayazilim Florist_site: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2957

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection.This issue affects Florist Site: before 3.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDLisayazilimTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-13

2023-07-13 08:15Z

CRIT

CVE-2023-1547 — Elra Parkmatik: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-1547

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection. This issue affects Parkmatik: before 02.01-a51. CVSSv3.1 9.8 (CRITICAL) · EPSS 28th percentile

CWECWE 89VNDElraTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-13

2023-07-13 03:15Z

HIGH

CVE-2023-3343 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3343

The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to del CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile

CWECWE 502VNDWpeverestTYPVulnerability

8.8

CVSS v3.1

Edit Score

2023-07-13

2023-07-13 03:15Z

CRIT

CVE-2023-3342 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3342

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and ful CVSSv3.1 9.9 (CRITICAL) · EPSS 91th percentile

CWECWE 434VNDWpeverestTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2023-07-12

2023-07-12 14:15Z

HIGH

CVE-2023-3600 — Mozilla Firefox: During the worker lifecycle, a use-after-free condition could have occurred, which could have led

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3600

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 416VNDMozillaTYPVulnerability

8.8

CVSS v3.1

Edit Score

2023-07-12

2023-07-12 13:15Z

CRIT

CVE-2023-33668 — Digiexam Digiexam: up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-33668

DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 354VNDDigiexamTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-12

2023-07-12 05:15Z

HIGH

CVE-2023-3105 — Learndash Learndash: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3105

The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts. CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 639VNDLearndashTYPVulnerability

8.8

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 19:15Z

HIGH

CVE-2023-36884 — Microsoft Windows_10_1507: Windows Search Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36884in the wild

Windows Search Remote Code Execution Vulnerability CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 362VNDMicrosoftTYPVulnerabilitySTAitw exploited

7.5

CVSS v3.1

100

Edit Score

2023-07-11

2023-07-11 18:15Z

HIGH

CVE-2023-35311 — Microsoft 365_apps: Outlook Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35311in the wild

Microsoft Outlook Security Feature Bypass Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 367VNDMicrosoftTYPVulnerabilitySTAitw exploited

8.8

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 18:15Z

CRIT

CVE-2023-33150 — Microsoft 365_apps: Office Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-33150

Microsoft Office Security Feature Bypass Vulnerability CVSSv3.1 9.6 (CRITICAL) · EPSS 42th percentile

CWECWE 693VNDMicrosoftTYPVulnerability

9.6

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36755 — Siemens Ruggedcom_rox_mx5000_firmware: The SCEP CA Certificate Name parameter in the web interface of affected devices is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36755

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX CVSSv3.1 9.1 (CRITICAL) · EPSS 61th percentile

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36754 — Siemens Ruggedcom_rox_mx5000_firmware: The SCEP server configuration URL parameter in the web interface of affected devices is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36754

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36753 — Siemens Ruggedcom_rox_mx5000_firmware: The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36753

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36752 — Siemens Ruggedcom_rox_mx5000_firmware: The upgrade-app URL parameter in the web interface of affected devices is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36752

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36751 — Siemens Ruggedcom_rox_mx5000_firmware: The install-app URL parameter in the web interface of affected devices is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36751

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

CRIT

CVE-2023-36750 — Siemens Ruggedcom_rox_mx5000_firmware: The software-upgrade Url parameter in the web interface of affected devices is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36750

CWECWE 77VNDSiemensTYPVulnerability

9.1

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

HIGH

CVE-2023-36521 — Siemens Simatic_mv540_h_firmware: The result synchronization server of the affected products contains a vulnerability that may lead

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36521

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all so CVSSv3.1 8.6 (HIGH) · EPSS 49th percentile

CWECWE 770VNDSiemensTYPVulnerability

8.6

CVSS v3.1

Edit Score

2023-07-11

2023-07-11 10:15Z

HIGH

CVE-2023-36386 — Siemens Ruggedcom_rox_mx5000_firmware: A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36386

CWECWE 79VNDSiemensTYPVulnerability

8.8

CVSS v3.1

Edit Score

2023-07-10

2023-07-10 16:15Z

HIGH

CVE-2023-3271 — Sick Icr890-4_firmware: Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3271

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints. CVSSv3.1 8.2 (HIGH) · EPSS 44th percentile

CWECWE 284VNDAccessVNDSickTYPVulnerability

8.2

CVSS v3.1

Edit Score

2023-07-10

2023-07-10 16:15Z

CRIT

CVE-2023-3045 — Tise Parking_web_report: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3045

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tise Technology Parking Web Report allows SQL Injection.This issue affects Parking Web Report: before 2.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDTiseTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-10

2023-07-10 16:15Z

CRIT

CVE-2023-2852 — Softmedyazilim Selfpatron: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2852

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injection.This issue affects SelfPatron : before 2.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDSoftmedyazilimTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-10

2023-07-10 16:15Z

CRIT

CVE-2023-2046 — Yontemizleme Vehicle_tracking_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2046

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yontem Informatics Vehicle Tracking System allows SQL Injection.This issue affects Vehicle Tracking System: before 8. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDYontemizlemeTYPVulnerability

9.8

CVSS v3.1

Edit Score

2023-07-05

2023-07-05 10:15Z

HIGH

CVE-2023-37211 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-37211

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 787VNDMozillaTYPVulnerability

8.8

CVSS v3.1

Edit Score

Latest intel// live feed

The DPRK strikes using a new variant of RUSTBUCKET

CVE-2023-35070 — Vegagroup Web_collection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-2957 — Lisayazilim Florist_site: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-1547 — Elra Parkmatik: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-3343 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions

CVE-2023-3342 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to

CVE-2023-3600 — Mozilla Firefox: During the worker lifecycle, a use-after-free condition could have occurred, which could have led

CVE-2023-33668 — Digiexam Digiexam: up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access

CVE-2023-3105 — Learndash Learndash: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in

CVE-2023-36884 — Microsoft Windows_10_1507: Windows Search Remote Code Execution Vulnerability

CVE-2023-35311 — Microsoft 365_apps: Outlook Security Feature Bypass Vulnerability

CVE-2023-33150 — Microsoft 365_apps: Office Security Feature Bypass Vulnerability

CVE-2023-36755 — Siemens Ruggedcom_rox_mx5000_firmware: The SCEP CA Certificate Name parameter in the web interface of affected devices is

CVE-2023-36754 — Siemens Ruggedcom_rox_mx5000_firmware: The SCEP server configuration URL parameter in the web interface of affected devices is

CVE-2023-36753 — Siemens Ruggedcom_rox_mx5000_firmware: The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to

CVE-2023-36752 — Siemens Ruggedcom_rox_mx5000_firmware: The upgrade-app URL parameter in the web interface of affected devices is vulnerable to

CVE-2023-36751 — Siemens Ruggedcom_rox_mx5000_firmware: The install-app URL parameter in the web interface of affected devices is vulnerable to

CVE-2023-36750 — Siemens Ruggedcom_rox_mx5000_firmware: The software-upgrade Url parameter in the web interface of affected devices is vulnerable to

CVE-2023-36521 — Siemens Simatic_mv540_h_firmware: The result synchronization server of the affected products contains a vulnerability that may lead

CVE-2023-36386 — Siemens Ruggedcom_rox_mx5000_firmware: A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected

CVE-2023-3271 — Sick Icr890-4_firmware: Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to

CVE-2023-3045 — Tise Parking_web_report: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-2852 — Softmedyazilim Selfpatron: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-2046 — Yontemizleme Vehicle_tracking_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2023-37211 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with