by CIRT Team
Multiple Vulnerabilities in Adobe Could Allow for Arbitrary Code Execution
DESCRIPTIONMultiple vulnerabilities have been discovered in Adobe InDesign, Adobe Framemaker, and Adobe Experience Manager, the most severe of which could allow for arbitrary code execution. Adobe InDesign is a desktop publishing and typesetting software that can be used to create works such as posters, flyers, brochures, magazines, newspapers, presentations, books and ebooks. Adobe FrameMaker is a document processor designed for writing and editing large or...
Read More
by CIRT Team
Multiple Vulnerabilities in SAP Products Could Allow for Arbitrary Code Execution
DESCRIPTION Multiple vulnerabilities have been discovered in SAP products, the most severe of which could allow for arbitrary code execution. SAP is a software company which creates software to manage business operations and customer relations. Successful exploitation of the most severe of these vulnerabilities could allow an unauthenticated, remote attacker to execute code on the affected systems. Depending on the privileges associated with the application,...
Read More
by CIRT Team
Critical Patches Issued for Microsoft Products, September 08, 2020
DESCRIPTION Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts...
Read More
by CIRT Team
Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
DESCRIPTION Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution within the context of a privileged...
Read More
by CIRT Team
GRUB2 bootloader is vulnerable to buffer overflow
DESCRIPTIONGRUB2 is a multiboot boot loader that replaced GRUB Legacy in 2012. A boot loader is the first program that runs upon boot and loads the operating system. Many vendors also use a shim, a signed software package that contains the vendor’s certificate and code that verifies and runs the boot loader. This means that firmware Certificate Authority providers can just sign the shim as...
Read More
by CIRT Team
DoS and DDoS Attacks against Multiple Sectors
Original release date: September 4, 2020 The Cybersecurity and Infrastructure Security Agency (CISA) is aware of open-source reporting of targeted denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks against finance and business organizations worldwide. A DoS attack is accomplished by flooding the targeted host or network with traffic until the target cannot respond or simply crashes, preventing access for legitimate users. In a DDoS attack, the...
Read More
by CIRT Team
Indicator of compromise (IoC) of Emotet Malware
Short Description: About Emotet Malware: Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. The spam emails contain either a URL or an attachment, and purport to be sending...
Read More
by CIRT Team
Updated Indicator of compromise (IoC) of FASTCash 2.0
Short Description: About BeagleBoyz: “BeagleBoyz ” is a newly identified group that is a subset of activity by the threat actors known as HIDDEN COBRA/LAZARUS/APT 38. The primary modus operandi (not limited to) of the BeagleBoyz is social engineering, spearphishing, and watering hole tactics. Contained within the Malware Analysis Reports (MAR) cited above are unique malware samples that are a combination of remote access tools/trojans...
Read More
by CIRT Team
A Vulnerability in WordPress File Manager Plugin Could Allow for Remote Code Execution
DESCRIPTIONA vulnerability has been discovered in the File Manager plugin that could allow for remote code execution. WordPress is a web-based publishing application implemented in PHP, and the File Manager Plugin allows site Admins to upload, edit, delete files and folders directly from the WordPress backend without having to use FTP. Successful exploitation of this vulnerability could allow for remote code execution in the context...
Read More
by CIRT Team
Multiple Vulnerabilities in Cisco Jabber for Windows Could Allow for Arbitrary Code Execution
DESCRIPTIONMultiple vulnerabilities have been discovered in Cisco Jabber for Windows the most severe of which could allow for arbitrary code execution. Cisco Jabber provides instant messaging (IM), voice, video, voice messaging, desktop sharing, and conferencing on any device. Successful exploitation of the most severe of these vulnerabilities could allow an unauthenticated, remote attacker to execute code on the affected systems. Depending on the privileges associated...
Read More
