Aruba fixes critical vulnerabilities in EdgeConnect Enterprise Orchestrator.
https://securityaffairs.co/wordpress/137000/security/aruba-edgeconnect-flaws.html
https://securityaffairs.co/wordpress/137000/security/aruba-edgeconnect-flaws.html
Security Affairs
Aruba fixes critical flaws in EdgeConnect Enterprise Orchestrator
Aruba addressed multiple critical severity vulnerabilities in the EdgeConnect Enterprise Orchestrator ...................
Active Directory Certificate Services Elevation of Privilege Vulnerability
CVE-2022-37976
CVSS: 8.8
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37976
CVE-2022-37976
CVSS: 8.8
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37976
ICS Advisory (ICSA-22-291-01)
EXECUTIVE SUMMARY
CVSS v3: 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Advantech
Equipment: R-SeeNet
Vulnerabilities: Path Traversal, Stack-based Buffer Overflow
RISK EVALUATION
Successful exploitation of these vulnerabilities could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution.
https://www.cisa.gov/uscert/ics/advisories/icsa-22-291-01
EXECUTIVE SUMMARY
CVSS v3: 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Advantech
Equipment: R-SeeNet
Vulnerabilities: Path Traversal, Stack-based Buffer Overflow
RISK EVALUATION
Successful exploitation of these vulnerabilities could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution.
https://www.cisa.gov/uscert/ics/advisories/icsa-22-291-01
RCE en la librería Apache Commons Text
Fecha de publicación: 18/10/2022
Identificador: INCIBE-2022-0975
Importancia: 5 - Crítica
Recursos afectados:
Apache Commons Text, desde la versión 1.5 hasta la 1.9, ambas incluidas.
Descripción:
Apache ha publicado una vulnerabilidad en su librería Apache Commons Text que podría permitir a un atacante remoto ejecutar código.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/rce-libreria-apache-commons-text
Fecha de publicación: 18/10/2022
Identificador: INCIBE-2022-0975
Importancia: 5 - Crítica
Recursos afectados:
Apache Commons Text, desde la versión 1.5 hasta la 1.9, ambas incluidas.
Descripción:
Apache ha publicado una vulnerabilidad en su librería Apache Commons Text que podría permitir a un atacante remoto ejecutar código.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/rce-libreria-apache-commons-text
INCIBE-CERT
RCE en la librería Apache Commons Text
Apache ha publicado una vulnerabilidad en su librería Apache Commons Text que podría permitir a un atacante remoto ejecutar código.
Actualización de seguridad 6.0.3 para WordPress
Fecha de publicación: 18/10/2022
Identificador: INCIBE-2022-0974
Importancia: 4 - Alta
Recursos afectados:
WordPress, versiones anteriores a 6.0.3.
Descripción:
Se ha publicado la última versión de WordPress que contiene correciones de seguridad.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-603-wordpress
Fecha de publicación: 18/10/2022
Identificador: INCIBE-2022-0974
Importancia: 4 - Alta
Recursos afectados:
WordPress, versiones anteriores a 6.0.3.
Descripción:
Se ha publicado la última versión de WordPress que contiene correciones de seguridad.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-603-wordpress
INCIBE-CERT
Actualización de seguridad 6.0.3 para WordPress
Se ha publicado la última versión de WordPress que contiene correciones de seguridad.
Analysis of a Remote Code Execution (RCE) Vulnerability in Cobalt Strike 4.7.1
https://securityintelligence.com/posts/analysis-rce-vulnerability-cobalt-strike/
https://securityintelligence.com/posts/analysis-rce-vulnerability-cobalt-strike/
Ibm
Security | IBM
Leverage educational content like blogs, articles, videos, courses, reports and more, crafted by IBM experts, on emerging security and identity technologies.
Actualizaciones críticas en Oracle (octubre 2022)
Fecha de publicación: 19/10/2022
Identificador: INCIBE-2022-0977
Importancia: 5 - Crítica
Descripción:
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades, que afectan a múltiples productos.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-octubre-2022
Fecha de publicación: 19/10/2022
Identificador: INCIBE-2022-0977
Importancia: 5 - Crítica
Descripción:
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades, que afectan a múltiples productos.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-octubre-2022
INCIBE-CERT
Actualizaciones críticas en Oracle (octubre 2022)
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades, que afectan a múltiples productos.
CVE-2022-28762: Zoom for macOS contains a debugging port misconfiguration.
Video messaging company Zoom fixed a high-severity vulnerability, tracked as CVE-2022-28762, in Zoom Client for Meetings for macOS.
Zoom Client for Meetings for macOS (Standard and for IT Admin) is affected by a debugging port misconfiguration. The issue, tracked as CVE-2022-28762, received a CVSS severity score of 7.3. When the camera mode rendering context is enabled as part of the Zoom App Layers API by running specific Zoom Apps, a local debugging port is opened by the client. A local malicious user can exploit the debugging port to connect to and control the Apps running in the Zoom client.
https://securityaffairs.co/wordpress/137266/security/zoom-macos-cve-2022-28762.html
Video messaging company Zoom fixed a high-severity vulnerability, tracked as CVE-2022-28762, in Zoom Client for Meetings for macOS.
Zoom Client for Meetings for macOS (Standard and for IT Admin) is affected by a debugging port misconfiguration. The issue, tracked as CVE-2022-28762, received a CVSS severity score of 7.3. When the camera mode rendering context is enabled as part of the Zoom App Layers API by running specific Zoom Apps, a local debugging port is opened by the client. A local malicious user can exploit the debugging port to connect to and control the Apps running in the Zoom client.
https://securityaffairs.co/wordpress/137266/security/zoom-macos-cve-2022-28762.html
Security Affairs
CVE-2022-28762: Zoom for macOS contains a debugging port misconfiguration
Video messaging company Zoom fixed a high-severity vulnerability, tracked as CVE-2022-28762, in Zoom Client for Meetings for macOS.
Dangerous hole in Apache Commons Text – like Log4Shell all over again.
https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
Sophos News
Naked Security – Sophos News
Microsoft fixes Windows TLS handshake failures in out-of-band updates.
Microsoft has issued an out-of-band (OOB) non-security update to address an issue triggering SSL/TLS handshake failures on client and server platforms.
On affected devices, users will see SEC_E_ILLEGAL_MESSAGE errors in applications when connections to servers experience issues.
"We address an issue that might affect some types of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections. These connections might have handshake failures," Microsoft explains.
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-tls-handshake-failures-in-out-of-band-updates/
Microsoft has issued an out-of-band (OOB) non-security update to address an issue triggering SSL/TLS handshake failures on client and server platforms.
On affected devices, users will see SEC_E_ILLEGAL_MESSAGE errors in applications when connections to servers experience issues.
"We address an issue that might affect some types of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections. These connections might have handshake failures," Microsoft explains.
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-tls-handshake-failures-in-out-of-band-updates/
BleepingComputer
Microsoft fixes Windows TLS handshake failures in out-of-band updates
Microsoft has issued an out-of-band (OOB) non-security update to address an issue caused by the October 2022 Windows security updates that triggers SSL/TLS handshake failures on client and server platforms.
SysAdmin 24x7
CVE-2022-28762: Zoom for macOS contains a debugging port misconfiguration. Video messaging company Zoom fixed a high-severity vulnerability, tracked as CVE-2022-28762, in Zoom Client for Meetings for macOS. Zoom Client for Meetings for macOS (Standard and…
Zoom for Mac patches sneaky “spy-on-me” bug – update now!
https://nakedsecurity.sophos.com/2022/10/18/zoom-for-mac-patches-sneaky-spy-on-me-bug-update-now/
https://nakedsecurity.sophos.com/2022/10/18/zoom-for-mac-patches-sneaky-spy-on-me-bug-update-now/
Naked Security
Zoom for Mac patches sneaky “spy-on-me” bug – update now!
Hey! That back door isn’t supposed to be there at all, let alone propped open…
Microsoft data breach exposes customers’ contact info, emails.
Microsoft said today that some of its customers' sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.
The company secured the server after being notified of the leak on September 24, 2022 by security researchers at threat intelligence firm SOCRadar.
"This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers, such as the planning or potential implementation and provisioning of Microsoft services," the company revealed.
https://www.bleepingcomputer.com/news/security/microsoft-data-breach-exposes-customers-contact-info-emails/
Microsoft said today that some of its customers' sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.
The company secured the server after being notified of the leak on September 24, 2022 by security researchers at threat intelligence firm SOCRadar.
"This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers, such as the planning or potential implementation and provisioning of Microsoft services," the company revealed.
https://www.bleepingcomputer.com/news/security/microsoft-data-breach-exposes-customers-contact-info-emails/
BleepingComputer
Microsoft data breach exposes customers’ contact info, emails
Microsoft said today that some of its customers' sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.
Credenciales LDAP expuestas en Liferay
Fecha de publicación: 20/10/2022
Identificador: INCIBA-2022-0979
Importancia: 5 - Crítica
Recursos afectados:
La funcionalidad Test LDAP Users en Liferay Portal 7.0.0 a 7.4.3.4.
Descripción:
Se ha identificado una vulnerabilidad crítica que incluye credenciales del protocolo LDAP en la URL al paginar la lista de usuarios.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/credenciales-ldap-expuestas-liferay
Fecha de publicación: 20/10/2022
Identificador: INCIBA-2022-0979
Importancia: 5 - Crítica
Recursos afectados:
La funcionalidad Test LDAP Users en Liferay Portal 7.0.0 a 7.4.3.4.
Descripción:
Se ha identificado una vulnerabilidad crítica que incluye credenciales del protocolo LDAP en la URL al paginar la lista de usuarios.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/credenciales-ldap-expuestas-liferay
INCIBE-CERT
Credenciales LDAP expuestas en Liferay
Se ha identificado una vulnerabilidad crítica que incluye credenciales del protocolo LDAP en la URL al paginar la lista de usuarios.
Ejecución de código remoto en productos de F5
Fecha de publicación: 20/10/2022
Identificador: INCIBE-2022-0980
Importancia: 5 - Crítica
Recursos afectados:
El componente iControl REST en BIG-IP (WAF avanzado, ASM) en las versiones:
desde la 16.1.0 hasta 16.1.3;
desde la 15.1.0 hasta 15.1.6;
desde la 14.1.0 hasta 14.1.5;
desde la 13.1.0 hasta 13.1.5.
Descripción:
Existe una vulnerabilidad de ejecución de código remota en la interfaz de BIG-IP iControl REST cuando se suministra el módulo 5 BIG-IP Advanced WAF o BIG-IP ASM.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/ejecucion-codigo-remoto-productos-f5
Fecha de publicación: 20/10/2022
Identificador: INCIBE-2022-0980
Importancia: 5 - Crítica
Recursos afectados:
El componente iControl REST en BIG-IP (WAF avanzado, ASM) en las versiones:
desde la 16.1.0 hasta 16.1.3;
desde la 15.1.0 hasta 15.1.6;
desde la 14.1.0 hasta 14.1.5;
desde la 13.1.0 hasta 13.1.5.
Descripción:
Existe una vulnerabilidad de ejecución de código remota en la interfaz de BIG-IP iControl REST cuando se suministra el módulo 5 BIG-IP Advanced WAF o BIG-IP ASM.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/ejecucion-codigo-remoto-productos-f5
www.incibe.es
Ejecución de código remoto en productos de F5
Existe una vulnerabilidad de ejecución de código remota en la interfaz de BIG-IP iControl REST cuando
Múltiples vulnerabilidades en Adobe iota All-In-One Security Kit
Fecha de publicación: 21/10/2022
Identificador: INCIBE-2022-0983
Importancia: 5 - Crítica
Recursos afectados:
Abode iota All-In-One Security Kit, versiones 6.9X y 6.9Z.
Descripción:
Matt Wiseman, investigador de Cisco Talos, ha reportado varias vulnerabilidades, algunas de ellas críticas, en Abode iota All-In-One Security Kit, cuya explotación podría permitir a un atacante cambiar credenciales, inyectar código, modificar información sensible de configuración, apagar el sistema, divulgar información o causar una condición de denegación de servicio (DoS), entre otras acciones.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-adobe-iota-all-one-security-kit
Fecha de publicación: 21/10/2022
Identificador: INCIBE-2022-0983
Importancia: 5 - Crítica
Recursos afectados:
Abode iota All-In-One Security Kit, versiones 6.9X y 6.9Z.
Descripción:
Matt Wiseman, investigador de Cisco Talos, ha reportado varias vulnerabilidades, algunas de ellas críticas, en Abode iota All-In-One Security Kit, cuya explotación podría permitir a un atacante cambiar credenciales, inyectar código, modificar información sensible de configuración, apagar el sistema, divulgar información o causar una condición de denegación de servicio (DoS), entre otras acciones.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-adobe-iota-all-one-security-kit
www.incibe.es
Múltiples vulnerabilidades en Adobe iota All-In-One Security Kit
Matt Wiseman, investigador de Cisco Talos, ha reportado varias vulnerabilidades, algunas de ellas crít
Cisco Releases Security Update for Cisco Identity Services Engine
Cisco has released a security update to address vulnerabilities affecting Cisco Identity Services Engine (ISE). A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing high and low severity vulnerabilities, see the Cisco Security Advisories page.
CISA encourages users and administrators to review Cisco Advisory cisco-sa-ise-path-trav-Dz5dpzyM and apply the necessary updates.
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/21/cisco-releases-security-update-cisco-identity-services-engine
Cisco has released a security update to address vulnerabilities affecting Cisco Identity Services Engine (ISE). A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing high and low severity vulnerabilities, see the Cisco Security Advisories page.
CISA encourages users and administrators to review Cisco Advisory cisco-sa-ise-path-trav-Dz5dpzyM and apply the necessary updates.
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/21/cisco-releases-security-update-cisco-identity-services-engine
www.cisa.gov
Cisco Releases Security Update for Cisco Identity Services Engine | CISA
Cisco has released a security update to address vulnerabilities affecting Cisco Identity Services Engine (ISE). A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing high and low severity…
Apple Fixes Exploited Zero-Day With iOS 16.1 Patch
Apple on Monday shipped a major iOS update with fixes at least 20 documented security defects, including a kernel flaw that’s already being actively exploited in the wild.
https://www.securityweek.com/apple-fixes-exploited-zero-day-ios-161-patch
Apple on Monday shipped a major iOS update with fixes at least 20 documented security defects, including a kernel flaw that’s already being actively exploited in the wild.
https://www.securityweek.com/apple-fixes-exploited-zero-day-ios-161-patch
SecurityWeek
Apple Fixes Exploited Zero-Day With iOS 16.1 Patch
Apple on Monday shipped a major iOS update with fixes for at least 20 documented security defects, including a kernel flaw that’s already being actively exploited in the wild.
Múltiples vulnerabilidades en Forma LMS
Fecha de publicación: 25/10/2022
Identificador: INCIBE-2022-0982
Importancia: 5 - Crítica
Recursos afectados:
Forma LMS, versión 3.1.0.
Solución:
Esta vulnerabilidad ha sido resuelta por Forma en LMS versión 3.2.1.
incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-forma-lms
Fecha de publicación: 25/10/2022
Identificador: INCIBE-2022-0982
Importancia: 5 - Crítica
Recursos afectados:
Forma LMS, versión 3.1.0.
Solución:
Esta vulnerabilidad ha sido resuelta por Forma en LMS versión 3.2.1.
incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-forma-lms
www.incibe.es
Multiples Vulnerabilidades Forma Lms | INCIBE-CERT | INCIBE
INCIBE ha coordinado la publicación de 6 vulnerabilidades en Forma LMS, que han sido descubiertas por
VMSA-2022-0027
CVSSv3 Range: 5.3-9.8
Issue Date: 2022-10-25
Updated On:2022-10-25 (Initial Advisory)
CVE(s): CVE-2021-39144, CVE-2022-31678
Synopsis:
VMware Cloud Foundation updates address multiple vulnerabilities.
Description
VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
https://www.vmware.com/security/advisories/VMSA-2022-0027.html
CVSSv3 Range: 5.3-9.8
Issue Date: 2022-10-25
Updated On:2022-10-25 (Initial Advisory)
CVE(s): CVE-2021-39144, CVE-2022-31678
Synopsis:
VMware Cloud Foundation updates address multiple vulnerabilities.
Description
VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
https://www.vmware.com/security/advisories/VMSA-2022-0027.html
Microsoft fixes Windows vulnerable driver blocklist sync issue.
Microsoft says it addressed an issue preventing its vulnerable driver blocklist from being synced to systems running older Windows versions.
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/
Microsoft says it addressed an issue preventing its vulnerable driver blocklist from being synced to systems running older Windows versions.
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/
BleepingComputer
Microsoft fixes Windows vulnerable driver blocklist sync issue
Microsoft says it addressed an issue preventing the Windows kernel vulnerable driver blocklist from being synced to systems running older Windows versions.
Samba Releases Security Updates
The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.
CISA encourages users and administrators to review the following Samba Security Announcements and apply the necessary updates and workarounds.
• CVE-2022-3437
• CVE-2022-3592
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/26/samba-releases-security-updates
The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.
CISA encourages users and administrators to review the following Samba Security Announcements and apply the necessary updates and workarounds.
• CVE-2022-3437
• CVE-2022-3592
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/26/samba-releases-security-updates
www.cisa.gov
Samba Releases Security Updates | CISA
The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review…