{"id":12080,"date":"2022-11-04T03:01:38","date_gmt":"2022-11-04T10:01:38","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=12080"},"modified":"2023-04-19T04:16:04","modified_gmt":"2023-04-19T11:16:04","slug":"securins-threat-intelligence-october-31-2022-november-4-2022","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-october-31-2022-november-4-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence &#8211; Oct 31, 2022 &#8211; Nov 4, 2022"},"content":{"rendered":"<p dir=\"ltr\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong><span style=\"font-size: 16px;\"><span style=\"color: #0000cd;\">Why play catch up when you can fix this now?<\/span><\/span><\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong><span style=\"font-size: 16px;\"><span style=\"color: #0000cd;\">Watch David Rushton elaborate on the top three critical threats of the week on our podcast!<\/span><\/span><\/strong><\/p>\n<div style=\"padding: 75% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"November 4_CSW Threat Intelligence PODCAST.mov\" src=\"https:\/\/player.vimeo.com\/video\/767378243?h=31e49236c9&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p dir=\"ltr\"><strong><span style=\"font-size: 14px;\">Trending Threats<\/span><\/strong><\/p>\n<ul dir=\"ltr\">\n<li><a href=\"#CISA Adds 1 More Vulnerability to the KEV\">CISA Adds 1 More Vulnerability to the KEV<\/a><\/li>\n<li><a href=\"#New Malware from Cranefly: Geppei\">New Malware from Cranefly: Geppei<\/a><\/li>\n<li><a href=\"#LockBit Adds More CVEs to its Assault Arsenal\">LockBit Adds More CVEs to its Assault Arsenal<\/a><\/li>\n<li><a href=\"#BlackBasta Ransomware Linked to FIN7\">BlackBasta Ransomware Linked to FIN7<\/a><\/li>\n<\/ul>\n<p><strong><span style=\"font-size: 14px;\">Threats to Watch Out For<\/span><\/strong><\/p>\n<ul>\n<li><a href=\"#Critical Vulnerabilities Addressed in OpenSSL\u00a0\">Critical Vulnerabilities Addressed in OpenSSL\u00a0<\/a><\/li>\n<li><a href=\"#Vulnerabilities in Apache Batik Library\">Vulnerabilities in Apache Batik Library<\/a><\/li>\n<li><a href=\"#Juniper Fixes Critical Vulnerabilities in Junos OS\u00a0\">Juniper Fixes Critical Vulnerabilities in Junos OS<\/a><\/li>\n<\/ul>\n<h3 dir=\"ltr\"><\/h3>\n<h2 dir=\"ltr\" style=\"text-align: center;\">Trending Threats<\/h2>\n<h2 dir=\"ltr\" style=\"text-align: center;\"><\/h2>\n<h3 dir=\"ltr\"><a id=\"CISA Adds 1 More Vulnerability to the KEV\" name=\"CISA Adds 1 More Vulnerability to the KEV\"><\/a>CISA Adds 1 More Vulnerability to the KEV<\/h3>\n<p dir=\"ltr\">On Oct 28, 2022, CISA added CVE-2022-3723 to the KEV. It is an actively-exploited Google Chrome zero-day vulnerability. It is described as a type confusion flaw in the V8 JavaScript engine. On abusing this vulnerability, an attacker will be able to read sensitive information of other apps, cause crashes, or execute arbitrary code. Chrome released a <a href=\"https:\/\/chromereleases.googleblog.com\/2022\/10\/stable-channel-update-for-desktop_27.html\">patch<\/a> for it on Oct 27, 2022 after multiple exploit campaigns in the wild.<\/p>\n<p dir=\"ltr\"><strong>CVE Details<\/strong><\/p>\n<table border=\"1\" align=\"center\">\n<colgroup>\n<col width=\"101\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"47\" \/>\n<col width=\"45\" \/>\n<col width=\"35\" \/>\n<col width=\"78\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V2 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V2 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CWE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Affected Product Count<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Patch Link<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-3723<\/p>\n<\/td>\n<td><\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\">8.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-843<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">1<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/chromereleases.googleblog.com\/2022\/10\/stable-channel-update-for-desktop_27.html\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\"><a id=\"New Malware from Cranefly: Geppei\" name=\"New Malware from Cranefly: Geppei\"><\/a>New Malware from Cranefly: Geppei<\/h3>\n<p dir=\"ltr\">Hacking group Cranefly has been using new malwares on target systems. Their latest technique is using reading commands from IIS (Internet Information Service) logs to communicate with an unknown dropper trojan known as Geppei to install backdoors and other custom tools. The malware used to distribute and gather information are Danfuan and Regeorg. Cranefly spent at least 18 months on victim networks and used backdoors on devices that didn\u2019t support security tools to remain undetected.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Cranefly deploys these backdoors to mainly gather intelligence from corporate organizations using phishing emails to their employees. From their techniques, it looks like they are a sophisticated group of attackers with intelligence gathering as the main motive.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">IIS logs have never before been used in cyber attacks and in future, this technique could be used to deliver different types of malware if leveraged by threat actors with malicious goals.<\/p>\n<h3 dir=\"ltr\"><a id=\"LockBit Adds More CVEs to its Assault Arsenal\" name=\"LockBit Adds More CVEs to its Assault Arsenal\"><\/a>LockBit Adds More CVEs to its Assault Arsenal<\/h3>\n<p dir=\"ltr\">LockBit has added more CVEs to its exploit list. Among them, Microsoft vulnerabilities are widely targeted and abused. LockBit\u2019s latest attacks were on Thales, a French defence and technology group. LockBit claimed that data had been stolen from the organization and threatened to publish it if their ransom demands aren\u2019t met by Nov 7, 2022.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">They also claimed responsibility for a cyberattack against the German multinational automotive group Continental in which data was stolen.<\/p>\n<p><strong>CVE Details<\/strong><\/p>\n<p dir=\"ltr\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/jqttK9jXfBgalVlHsDm1a4FjgICQnK7UhYq2cNL_lsGxTB45tP0BxXBdnAswwQvrUHIljRtT8fw8wZmfSS7cxg9jy-W_Q2LqGd6YIsnwvjL8ZsOh6ujvb6-76Iwfp-2QCQ-ngV8es6exCVnaRLUQoSfY-CNrkWIuqr89o9viSYVwaqGX-bp2vUSR3IJE3w\" width=\"624\" height=\"445\" \/><\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\"><a id=\"BlackBasta Ransomware Linked to FIN7\" name=\"BlackBasta Ransomware Linked to FIN7\"><\/a>BlackBasta Ransomware Linked to FIN7<\/h3>\n<p dir=\"ltr\">Recent research has revealed that BlackBasta ransomware may be linked to a financially motivated Russian hacking group FIN7 (AKA Carbanak). In attack analysis of both groups, researchers found that the (Endpoint Detection and Response) evasion tools had the same authors. BlackBasta has been using these EDR tools since June 2022. In their recent attacks, SocksBot malware samples were also found which is a backdoor used exclusively by FIN7.<\/p>\n<p dir=\"ltr\">FIN7 was observed using Cobalt Strike and Meterpreter C2 frameworks in simulated malware-dropping attacks earlier this year. BlackBasta used the same TTPs and IP addresses in the following months, another indication of collaboration between the groups.<\/p>\n<p dir=\"ltr\">FIN7 has previously worked with multiple ransomware groups namely, Maze, Ryuk, Darkside, and BlackCat\/ALPHV for initial compromise.<\/p>\n<p>CVE-2022-30190, CVE-2020-1472, CVE-2021-42287, CVE-2021-42278, and CVE-2021-34527 are exploited by BlackBasta and FIN7.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><strong>CVE Details<\/strong><\/p>\n<table border=\"1\" align=\"left\">\n<colgroup>\n<col width=\"31\" \/>\n<col width=\"30\" \/>\n<col width=\"37\" \/>\n<col width=\"30\" \/>\n<col width=\"40\" \/>\n<col width=\"31\" \/>\n<col width=\"40\" \/>\n<col width=\"31\" \/>\n<col width=\"29\" \/>\n<col width=\"26\" \/>\n<col width=\"28\" \/>\n<col width=\"35\" \/>\n<col width=\"30\" \/>\n<col width=\"76\" \/>\n<col width=\"45\" \/>\n<col width=\"45\" \/>\n<col width=\"37\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CWE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Attack Classification<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Ransomware Names<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Threat Actor Names<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Patch Link<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-30190<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\">RCE,WebApp,Other<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">Bisamware<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">APT29 | UAC-0098 | Leviathan | Sandworm Team | TA413<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2022-30190\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-34527<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-269<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">RCE,DoS,Other<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">Conti | Vice Society | Black Basta | Magniber<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">DEV-0832<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2021-34527\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-42278<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-269<\/p>\n<\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\">Black Basta<\/p>\n<\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2021-42278\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-42287<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-269<\/p>\n<\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\">Black Basta<\/p>\n<\/td>\n<td><\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2021-42287\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2020-1472<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">10.00<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">10<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-330 | CWE-287<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">PE,DoS,WebApp,Other<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">Darkside | Conti | Ryuk | CLOP | Thanos | Black Basta | Babuk | Epsilon Red<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">Wizard Spider | Prophet Spider | MuddyWater | TA505 | menuPass | FIN7 | Sandworm Team | Earth Lusca<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-1472\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\" style=\"text-align: center;\"><strong>Threats to Watch Out For<\/strong><\/h2>\n<h3 dir=\"ltr\"><\/h3>\n<h3 dir=\"ltr\"><a id=\"Critical Vulnerabilities Addressed in OpenSSL\u00a0\" name=\"Critical Vulnerabilities Addressed in OpenSSL\u00a0\"><\/a>Critical Vulnerabilities Addressed in OpenSSL<\/h3>\n<p dir=\"ltr\"><strong>CVE-2022-3602<\/strong> and <strong>CVE-2022-3786<\/strong> are vulnerabilities found in OpenSSL, an open-source cryptography library that allows for the implementation of secure communications online.<\/p>\n<p dir=\"ltr\">CVE-2022-3602 allows a crafted email address to overflow exactly four attacker-controlled bytes on the stack allowing access to the server.<\/p>\n<p dir=\"ltr\">CVE-2022-3786 can overflow an arbitrary number of bytes on the stack with the &#8220;.&#8221; character leading to denial of service on a client authenticated server.<\/p>\n<p dir=\"ltr\">Initial access through these vulnerabilities is complicated and requires pre-authenticated configurations, limiting widespread exploitation.<\/p>\n<p dir=\"ltr\">OpenSSL has released a <a href=\"https:\/\/www.openssl.org\/news\/secadv\/20221101.txt\">security advisory<\/a> to help fix these vulnerabilities.<\/p>\n<p dir=\"ltr\"><strong>CVE Details<\/strong><\/p>\n<table border=\"1\" align=\"center\">\n<colgroup>\n<col width=\"101\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"47\" \/>\n<col width=\"45\" \/>\n<col width=\"35\" \/>\n<col width=\"78\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CWE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Affected Product Count<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Patch Link<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-3602<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">9.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">9.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-120 , CWE-119 , CWE-121<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/www.openssl.org\/news\/secadv\/20221101.txt\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-3786<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.50<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.5<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-120 , CWE-193 , CWE-119 , CWE-121<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/www.openssl.org\/news\/secadv\/20221101.txt\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 dir=\"ltr\"><a id=\"Vulnerabilities in Apache Batik Library\" name=\"Vulnerabilities in Apache Batik Library\"><\/a>Vulnerabilities in Apache Batik Library<\/h3>\n<p dir=\"ltr\">CVE-2022-40146 is a Server-Side Request Forgery (SSRF) vulnerability that could potentially allow remote attackers to execute arbitrary code on affected installations of Apache Batik. It is caused by the lack of proper validation of a URI prior to accessing resources.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><a href=\"https:\/\/lists.apache.org\/thread\/712c9xwtmyghyokzrm2ml6sps4xlmbsx\">CVE-2022-38398<\/a> is also a SSRF vulnerability that allows remote attackers to disclose sensitive information on affected installations of Apache Batik.<\/p>\n<p style=\"text-align: center;\"><strong>Users are recommended to upgrade to Apache Batik 1.15 latest version to resolve these vulnerabilities.<\/strong><\/p>\n<p dir=\"ltr\"><strong>CVE Details<\/strong><\/p>\n<table border=\"1\" align=\"center\">\n<colgroup>\n<col width=\"101\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"47\" \/>\n<col width=\"45\" \/>\n<col width=\"35\" \/>\n<col width=\"78\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CWE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Affected Product Count<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Patch Link<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-40146<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.50<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.5<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-918<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">1<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/lists.apache.org\/thread\/hxtddqjty2sbs12y97c8g7xfh17jzxsx\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-38398<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">5.30<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">5.3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-918<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">1<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/lists.apache.org\/thread\/712c9xwtmyghyokzrm2ml6sps4xlmbsx\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 dir=\"ltr\"><a id=\"Juniper Fixes Critical Vulnerabilities in Junos OS\u00a0\" name=\"Juniper Fixes Critical Vulnerabilities in Junos OS\u00a0\"><\/a>Juniper Fixes Critical Vulnerabilities in Junos OS<\/h3>\n<p dir=\"ltr\">6 high-severity vulnerabilities in Juniper Junos OS affect enterprise networking devices. They\u00a0are:<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-22241<\/strong> &#8211; Remote pre-authenticated PHP archive file deserialization vulnerability<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-22242<\/strong> &#8211; A pre-authenticated reflected XSS allowing a remote adversary to siphon Junos OS admin session and chained with other flaws that require authentication.<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-22243 <\/strong>and <strong>CVE-2022-22244<\/strong> &#8211; Two XPATH injection flaws that allow a remote authenticated attacker to steal and manipulate Junos OS admin sessions<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-22245<\/strong> &#8211; A path traversal flaw that could allow a remote authenticated attacker to upload PHP files to any arbitrary location<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-22246<\/strong> &#8211; A local file inclusion vulnerability that could be weaponized to run untrusted PHP code.<\/p>\n<p dir=\"ltr\"><strong>Juniper released a <a href=\"https:\/\/supportportal.juniper.net\/s\/article\/2022-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-in-J-Web?language=en_US\">security advisory<\/a> on how to patch these vulnerabilities.<\/strong><\/p>\n<p dir=\"ltr\"><strong>CVE Details<\/strong><\/p>\n<table border=\"1\" align=\"center\">\n<colgroup>\n<col width=\"101\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"36\" \/>\n<col width=\"35\" \/>\n<col width=\"47\" \/>\n<col width=\"45\" \/>\n<col width=\"35\" \/>\n<col width=\"78\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">V3 Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Severity<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CWE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Affected Product Count<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">Patch Link<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22242<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">6.10<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">6.1<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-79<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">160<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22241<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">9.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">9.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CRITICAL<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-502 , CWE-20<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">161<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22243<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">4.30<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">4.3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-20 , CWE-91<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">162<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22246<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.80<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">HIGH<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-829<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">161<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22245<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">4.30<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">4.3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-22 , CWE-23<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">160<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-22244<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">5.30<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">5.3<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">MEDIUM<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">CWE-91<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">160<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><a href=\"https:\/\/kb.juniper.net\/JSA69899\">Download<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p dir=\"ltr\"><strong>We use our threat intelligence platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that hackers could potentially exploit. We warn our customers continuously about exposures and prioritize vulnerabilities to facilitate rapid remediation.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help managing your vulnerabilities and exposures.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Leverage our expertise and manage your threats continuously to stay safe from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting. | October 31, 2022 &#8211; November 4, 2022<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[89,116,91,103,108],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/12080"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=12080"}],"version-history":[{"count":7,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/12080\/revisions"}],"predecessor-version":[{"id":17829,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/12080\/revisions\/17829"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=12080"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=12080"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=12080"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}