SOS Intelligence

https://nvd.nist.gov/vuln/detail/CVE-2023-32844

The SOS Intelligence CVE Chatter Weekly Top Ten – 25 December 2023

by Amir Hadzipasic

December 25, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2023-32844

In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01130204; Issue ID: MOLY01130204 (MSV-849).

2. CVE-2023-29324

https://nvd.nist.gov/vuln/detail/CVE-2023-29324

3. CVE-2023-4966

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

https://nvd.nist.gov/vuln/detail/CVE-2023-50164

4. CVE-2023-50164

Microsoft Outlook Elevation of Privilege Vulnerability

5. CVE-2023-23397

Microsoft Outlook Elevation of Privilege Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2023-23397

6. CVE-2012-2459

Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows remote attackers to cause a denial of service (block-processing outage and incorrect block count) via unknown behavior on a Bitcoin network.

https://nvd.nist.gov/vuln/detail/CVE-2023-40044

7. CVE-2023-40044

8. CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.

https://nvd.nist.gov/vuln/detail/CVE-2023-32315

9. CVE-2023-32315

10. CVE-2021-42063

A security vulnerability has been discovered in the SAP Knowledge Warehouse – versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.

https://nvd.nist.gov/vuln/detail/CVE-2021-42063

https://nvd.nist.gov/vuln/detail/CVE-2023-23397

The SOS Intelligence CVE Chatter Weekly Top Ten – 18 December 2023

by Amir Hadzipasic

December 18, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2023-23397

Microsoft Outlook Elevation of Privilege Vulnerability

2. CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.

https://nvd.nist.gov/vuln/detail/CVE-2023-32243

3. CVE-2023-32243

Microsoft Outlook Elevation of Privilege Vulnerability

4. CVE-2023-42326

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

https://nvd.nist.gov/vuln/detail/CVE-2023-42326

5. CVE-2023-42327

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

https://nvd.nist.gov/vuln/detail/CVE-2023-42327

6. CVE-2023-32315

https://nvd.nist.gov/vuln/detail/CVE-2023-32315

7. CVE-2023-42325

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

https://nvd.nist.gov/vuln/detail/CVE-2023-42325

8. CVE-2023-6553

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

https://nvd.nist.gov/vuln/detail/CVE-2023-6553

9. CVE-2023-50164

Microsoft Outlook Elevation of Privilege Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2023-50164

10. CVE-2009-0658

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.

https://nvd.nist.gov/vuln/detail/CVE-2009-0658

The SOS Intelligence CVE Chatter Weekly Top Ten – 11 December 2023

by Amir Hadzipasic

December 11, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2023-40813

2. CVE-2023-40813

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.

3. CVE-2023-28370

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

https://nvd.nist.gov/vuln/detail/CVE-2023-28370

4. CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.

https://nvd.nist.gov/vuln/detail/CVE-2023-24023

5. CVE-2023-24023

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.

6. CVE-2023-32315

https://nvd.nist.gov/vuln/detail/CVE-2023-32315

7. CVE-2023-34124

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

https://nvd.nist.gov/vuln/detail/CVE-2023-34124

8. CVE-2022-30190

Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.

https://nvd.nist.gov/vuln/detail/CVE-2022-30190

9. CVE-2018-15473

https://nvd.nist.gov/vuln/detail/CVE-2018-15473

10. CVE-2023-45866

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

https://nvd.nist.gov/vuln/detail/CVE-2023-45866

Investigation, Ransomware

Ransomware – State of Play November 2023

by Daniel Collyer

December 6, 2023

SOS Intelligence is currently tracking 166 distinct ransomware groups. Data collection covers 309 relays and mirrors, 110 of which are currently online.

In the reporting period, SOS Intelligence has identified 437 instances of publicised ransomware attacks. These have been identified through the publication of victim details and data on ransomware blog sites accessible via Tor. Our analysis is presented below:

As in previous months, the ransomware landscape is dominated by strains using affiliate models. Lockbit remains the most active strain, and has seen a 73% increase in breach posts when compared to the previous month. High on the list is 8base, who release a large amount of data on 30th November. In contrast to the other high-profile groups observed, it is believed that the 8base group do not have their own proprietary ransomware, but instead rely on using other ransomware-as-a-service (RaaS) variants, such as Phobos.

As seen in previous months, the USA remains the primary target of ransomware groups and threat actors. We have observed an increased release of data from France, Germany and Italy, while the UK and Canada have remained high on the list of targeted countries.

As members of the G7, these countries have strong economies and therefore possess lucrative targets for financially-minded threat actors. However, this surge in activity may be politically motivated. In recent weeks these countries have all shown support for Israel in its conflict with Hamas, which may give certain threat actors additional motivation to target those countries.

Logistics, manufacturing, and construction have remained the key targeted industries for November. These industries would be more reliant on technology in order to continue their business activities, and so it logically follows that they would be more likely to pay a ransom in order to regain access to compromised computer systems. We are seeing a shift in tactics for certain industries, particularly those where data privacy carries a higher importance (such as legal or healthcare), where threat actors are not deploying encryption software and instead relying solely on data exfiltration as the main source of material for blackmail and extortion.

New for this month we have also considered the victim ownership; whether they’re privately or publicly owned. Within breach sites, the publicised victims are overwhelmingly privately owned. Publicly-owned victims tend to be either smaller, local government entities or educational districts within the US school system. Higher level public entities, while offering a lucrative target for hostile state actors, but may be more than a financially-motivated threat actor wishes to take on, owing to the likely increased law enforcement effort to obtain a judicial outcome.

Photo by FLY:D on Unsplash

https://nvd.nist.gov/vuln/detail/CVE-2023-46214

The SOS Intelligence CVE Chatter Weekly Top Ten – 04 December 2023

by Amir Hadzipasic

December 4, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2023-46214

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

2. CVE-2023-4966

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.

https://nvd.nist.gov/vuln/detail/CVE-2022-30190

3. CVE-2022-30190

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.

4. CVE-2009-0658

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.

https://nvd.nist.gov/vuln/detail/CVE-2009-0658

5. CVE-2023-6345

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

https://nvd.nist.gov/vuln/detail/CVE-2023-6345

6. CVE-2023-49103

https://nvd.nist.gov/vuln/detail/CVE-2023-49103

7. CVE-2012-2459

8. CVE-2023-48122

N/A

9. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2023-40813

10. CVE-2023-40813

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.

Flash Alert

Flash Alert – CitrixBleed victim with impacts on UK legal sector

by Daniel Collyer

November 27, 2023

CVE-2023-4966

CVSS: 9.4

In October 2023 we reported on an observation of a threat actor exploiting CVE-2023-4966, a vulnerability in Citrix NetScaler since dubbed CitrixBleed. Further information on that report can be found here.

This vulnerability allows threat actors to hijack existing, authenticated sessions and bypass multi-factor authentication. As a result, they could fully control NetScaler environments, and therefore manage and control application delivery.

We’d previously stated an expectation that this vulnerability would continue to be exploited, banking on a slow patch rate, and this prediction appears to have been correct. In the last week, it has been reported that managed service provider (MSP) CTS has suffered a significant cyberattack as a result of CitrixBleed.

CTS provides IT services for the UK legal sector. As a result of the attack, it is estimated that up to 200 UK firms and offices have been significantly impacted, resulting in a loss of access to systems and databases crucial for them to function. The incident was first noted on Wednesday (22^nd November 2023) and continued into the weekend. This has had a significant impact on property buyers, with Fridays being the busiest days for purchase completions.

There is limited information available regarding the overall scope of the attack against CTS, but it has been suggested that ransomware had been deployed, which we will continue to monitor for. It is unknown whether any sensitive or confidential information has been impacted, but the incident has been reported to the ICO.

The targeting of an MSP at this time is significant. The UK Government has decided to not include an update to the NIS Regulations within the most recent King’s Speech, meaning that these will likely not be considered until after the next general election in 2024. Updating these regulations would treat MSPs as critical infrastructure, and encourage them to focus on and improve their own cybersecurity and defences in order to prevent supply chain attacks. In the foreword to the UK Government’s “Proposal for legislation to improve the UK’s cyber resilience”, Julia Lopez MP, Minister of State for Media, Data, and Digital Infrastructure stated:

“an attractive and high value target for malicious threat actors, and can be used as staging points through which threat actors can compromise the clients of those managed services,”

This is not the first such attack against an MSP in the UK. In August 2022, IT supplier Advanced was targeted with ransomware, which had a serious impact on the NHS’s ability to deliver care. In January 2023 the UK National Cyber Security Centre (NCSC) issued a warning regarding the use of MSP’s, and that use of their services would increase an organisation’s attack surface. An MSP with access to multiple clients makes them a “juicy target” for threat actors wanting to cause as much disruption as possible.

Photo by Tingey Injury Law Firm on Unsplash.

https://nvd.nist.gov/vuln/detail/CVE-2023-40289

The SOS Intelligence CVE Chatter Weekly Top Ten – 27 November 2023

by Amir Hadzipasic

November 27, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2023-40289

N/A

2. CVE-2023-4966

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

https://nvd.nist.gov/vuln/detail/CVE-2023-32243

3. CVE-2023-32243

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

4. CVE-2023-36025

Windows SmartScreen Security Feature Bypass Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2023-36025

5. CVE-2023-22518

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

https://nvd.nist.gov/vuln/detail/CVE-2023-22518

6. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2023-38831

7. CVE-2023-38831

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

8. CVE-2023-28252

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

https://nvd.nist.gov/vuln/detail/CVE-2023-28252

9. CVE-2023-48122

N/A

https://nvd.nist.gov/vuln/detail/CVE-2022-30190

10. CVE-2022-30190

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.

Investigation, Ransomware

New SOS Intelligence Pricing

by Amir Hadzipasic

November 23, 2023

The SOS Intelligence CVE Chatter Weekly Top Ten – 20 November 2023

by Amir Hadzipasic

November 20, 2023

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2023-4966

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

2. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

3. CVE-2023-4863

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

4. CVE-2022-3696

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

https://nvd.nist.gov/vuln/detail/CVE-2022-3696

5. CVE-2021-21972

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

https://nvd.nist.gov/vuln/detail/CVE-2021-21972

6. CVE-2022-3236

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

https://nvd.nist.gov/vuln/detail/CVE-2022-3236

7. CVE-2020-1472

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka ‘Netlogon Elevation of Privilege Vulnerability’.

https://nvd.nist.gov/vuln/detail/CVE-2020-1472

8. CVE-2012-2459