CVE-2020-14883
published 2020-10-21CVE-2020-14883: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0…
PriorityP187high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
97.93%
99.9th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →IPS rule 1010590 detects and blocks exploitation of CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883 on Oracle WebLogic Server ↗
- →IPS rule 1004090 detects directory traversal sequences in URI, relevant to the double URL-encoded traversal used in CVE-2020-14883 exploitation ↗
- →Post-exploitation activity includes Java process spawning a bash shell — monitor for Java processes opening bash shells as an indicator of WebLogic exploitation ↗
- ·The Kinsing wb.sh stager checks for /tmp/zzza before executing; manually creating this file can prevent the stager from running further actions on a host, but this is not a substitute for patching ↗
- ·IPS rule 1010590 covers CVE-2020-14882, CVE-2020-14750, AND CVE-2020-14883 together — triggering on this rule does not isolate which specific CVE is being exploited ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck7.2HIGH
cisa7.2HIGH
vendor_oracle7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Oracle WebLogic Server Unspecified Vulnerability
cisa·2021-11-03·CVSS 7.2
CVE-2020-14883 [HIGH] Oracle WebLogic Server Unspecified Vulnerability
Vulnerability: Oracle WebLogic Server Unspecified Vulnerability
Affected: Oracle WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-14883
Remediation Due Date: 2022-05-03
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Console — CVE-2020-14883
vendor_oracle·2020-10-15·CVSS 7.2
CVE-2020-14883 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Console — CVE-2020-14883
Oracle Oracle Fusion Middleware Risk Matrix: Console vulnerability
CVE: CVE-2020-14883
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
GHSA
GHSA-26xh-4mrc-q8jf: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
ghsa_unreviewed·2022-05-24
CVE-2020-14883 [HIGH] GHSA-26xh-4mrc-q8jf: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle WebLogic Server Unspecified Vulnerability
vulncheck·2020·CVSS 7.2
CVE-2020-14883 [HIGH] Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Affected: Oracle WebLogic Server
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.trendmicro.com/en_us/research/22/i/a-post-exploitation-look-at-coinminers-abusing-weblogic-vulnerab.html; https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/initial-access-techniques-in-kubernetes-environments-used-by/ba-p/3697975; https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a; https://www.microsoft.com/content/dam/microsoft/final/en-us/microsoft
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)
suricata·2020-11-06·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"console.portal?"; http.request_body; content:".ClassPathXmlApplicationContext|28|"; fast_pattern; reference:url,github.com/jas502n/CVE-2020-14882; reference:cve,2020-14882; reference:cve,2020-14883; classtype:attempted-admin; sid:2031187; rev:1; metadata:created_at 2020_11_06, cve CVE_2020_14882, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_06;)
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)
suricata·2020-11-06·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"console.portal"; http.header; content:"|0d 0a|cmd|3a 20|"; fast_pattern; http.request_body; content:"_nfpb=true"; reference:url,github.com/jas502n/CVE-2020-14882; reference:cve,2020-14882; reference:cve,2020-14883; classtype:attempted-admin; sid:2031186; rev:1; metadata:created_at 2020_11_06, cve CVE_2020_14882, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_06;)
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)
suricata·2020-11-06·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"console.portal"; http.request_body; content:".sh.ShellSession"; fast_pattern; pcre:"/^(?:\x28|%28)/R"; reference:url,github.com/jas502n/CVE-2020-14882; reference:cve,2020-14882; reference:cve,2020-14883; classtype:attempted-admin; sid:2031185; rev:3; metadata:created_at 2020_11_06, cve CVE_2020_14882, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_12_04;)
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)
suricata·2020-11-06·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"console.portal"; http.request_body; content:".FileSystemXmlApplicationContext|28|"; fast_pattern; reference:url,github.com/jas502n/CVE-2020-14882; reference:cve,2020-14882; reference:cve,2020-14883; classtype:attempted-admin; sid:2031184; rev:2; metadata:created_at 2020_11_06, cve CVE_2020_14882, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_06;)
Suricata
ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)
suricata·2020-10-30·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)
Rule: alert http $EXTERNAL_NET any -> any any (msg:"ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)"; flow:established,to_server; http.uri.raw; content:"/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel="; content:"com.tangosol.coherence.mvel2.sh.ShellSession("; within:75; http.uri; content:"com.tangosol.coherence.mvel2.sh.ShellSession("; fast_pattern; content:"java.lang.Runtime.getRuntime("; distance:0; content:".exec"; distance:0; reference:url,isc.sans.edu/forums/diary/PATCH+NOW+CVE202014882+Weblogic+Actively+Exploited+Against+Honeypots/26734/; reference:url,packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-Code-Execution.html; reference:cve,2020-1488
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M1 (CVE-2020-14882)
suricata·2020-10-30·CVSS 9.8
CVE-2020-14882 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M1 (CVE-2020-14882)
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M1 (CVE-2020-14882)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M1 (CVE-2020-14882)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"console.portal?"; content:".sh.ShellSession|28|"; distance:0; fast_pattern; reference:url,packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-Code-Execution.html; reference:cve,2020-14882; reference:cve,2020-14883; classtype:attempted-admin; sid:2031143; rev:3; metadata:created_at 2020_10_30, cve CVE_2020_14882, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus,
Nuclei
Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
nuclei·CVSS 7.2
CVE-2020-14883 [HIGH] Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server.
Template:
id: CVE-2020-14883
info:
name: Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
author: pdteam,vicrack
severity: high
description: |
The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with networ
Metasploit
Oracle WebLogic Server Administration Console Handle RCE
metasploit
Oracle WebLogic Server Administration Console Handle RCE
Oracle WebLogic Server Administration Console Handle RCE
This module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against 12.2.1.3.0 from Vulhub (Linux) and on Windows. Warning! Multiple sessions may be created by exploiting this vuln.
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
blogs_hackernews·2026-03-30·CVSS 9.3
[CRITICAL] ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There's a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring until you see what it connects to.
All of it below. Let's go.
## ⚡ Threat of the Week
Citrix Flaw Comes Under Active Exploitation — A cr
Wiz
Crying Out Cloud - January Newsletter | Wiz
blogs_wiz·2024-01-01·CVSS 8.8
CVE-2023-26360 [HIGH] Crying Out Cloud - January Newsletter | Wiz
This month we’ve seen several vulnerabilities and security incidents that have left users affected. We know you're busy too, so we've sifted through the noise to bring you the real game-changers.
Here are our top picks!
## 🐞 High Profile Vulnerabilities
Adobe ColdFusion RCE vulnerability exploited in-the-wild
CVE-2023-26360 is a critical vulnerability in Adobe ColdFusion that was published in March 2023. This vulnerability could allow an attacker to execute arbitrary code on the remote server in the context of the current user. On December 5, 2023, CISA announced that threat actors were actively exploiting this vulnerability in order to gain initial access to government-owned servers. Customers should update Adobe ColdFusion to the latest version.
According to Wiz data, less than 1% o
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
blogs_trendmicro·2022-09-14·CVSS 9.8
CVE-2020-14882 [CRITICAL] A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
Exploits & Vulnerabilities
# A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
This blog entry details how Trend Micro Cloud One™ – Workload Security and Trend Micro Vision One™ effectively detected and blocked the abuse of the CVE-2020-14882 WebLogic vulnerability in affected endpoints.
By: Sunil Bharti
Sep 14, 2022
Read time: ( words)
Save to Folio
We have recently observed malicious actors exploiting both recently disclosed and older Oracle WebLogic Server vulnerabilities to deliver cryptocurrency-mining malware. Oracle WebLogic Server is typically used for developing and deploying high-traffic enterprise applications on cloud environments and engineered and conventional systems.
One of the older vulnerabilities that is still being actively exploited by mali
Trendmicro
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
blogs_trendmicro·2022-09-14·CVSS 9.8
CVE-2020-14882 [CRITICAL] A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
Exploits & Vulnerabilities
# A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
This blog entry details how Trend Micro Cloud One™ – Workload Security and Trend Micro Vision One™ effectively detected and blocked the abuse of the CVE-2020-14882 WebLogic vulnerability in affected endpoints.
By: Sunil Bharti
2022/09/14
Read time: ( words)
Save to Folio
We have recently observed malicious actors exploiting both recently disclosed and older Oracle WebLogic Server vulnerabilities to deliver cryptocurrency-mining malware. Oracle WebLogic Server is typically used for developing and deploying high-traffic enterprise applications on cloud environments and engineered and conventional systems.
One of the older vulnerabilities that is still being actively exploited by malici
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Trendmicro
Über Schwachstellen zum illegalen Monero-Mining
blogs_trendmicro·2021-12-03·CVSS 9.8
[CRITICAL] Über Schwachstellen zum illegalen Monero-Mining
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Trend Micro Dec 03, 2021 Read time: ( words)
Save to Folio
Originalbeitrag von Nitesh Surana, Threat Research Engineer
Anhänger der Kryptowährungen durchleben schwere Zeiten. Der Bitcoin stürzte ab und es gab aktuell einige Angriffsversuche , so berichtet vom Magazin Spiegel. Auch entdeckten wir vor ein paar Wochen kompromittierte Docker Hub-Konten , die für illegales Kryptowährungs-Mining missbraucht wurden. Nun haben wir uns auch mit entdeckten Exploit-Versuchen und dem Missbrauch der legitimen Plattformen Netlify und GitHub als Repositories für Malwa
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
# Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana
2021/12/03
Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Trendmicro
This Week in Security News – October 22, 2021
blogs_trendmicro·2021-10-22·CVSS 9.8
[CRITICAL] This Week in Security News – October 22, 2021
Cyber Crime
# This Week in Security News – October 22, 2021
In this week in security news, learn about a new backdoor from PurpleFox that utilizes WebSockets for more secure communication the link between the Sinclair ransomware attack and the cybercrime group Evil Corp.
By: Jon Clay
2021/10/22
Read time: ( words)
Save to Folio
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about a new backdoor from PurpleFox that utilizes WebSockets for more secure communication. Also, read on the link between the Sinclair ransomware attack and the cybercrime group Evil Corp.
Read on:
PurpleFox Adds New Backdoor That Uses WebSockets
In September 2021, Trend Micro‘s Managed XDR (MDR) tea
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Cyber Threats
## Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma 2021/10/18 Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084 , and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882 , CVE-202
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Cyber Threats
# Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma
2021/10/18
Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084, and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882, CVE-2020-
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Minacce cyber
## Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma Oct 18, 2021 Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084 , and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882 , CVE-2
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Cyber Threats
## Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma Oct 18, 2021 Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084 , and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882 , CVE-2
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Cyberbedrohungen
## Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma Oct 18, 2021 Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084 , and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882 , CV
Trendmicro
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
blogs_trendmicro·2021-10-18·CVSS 9.8
CVE-2021-26084 [CRITICAL] Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
Ciberamenazas
## Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
We look into campaigns that exploit the following server vulnerabilities: CVE-2021-26084, CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883.
By: Ashish Verma, Yash Verma Oct 18, 2021 Read time: ( words)
Save to Folio
Vulnerabilities serve as entry points for threats, and even relatively new ones have swarms of exploit campaigns that target them. In this research, we look into how malware campaigns target server vulnerabilities. In particular, we look into the Atlassian Confluence Server Webwork Object-Graph Navigation Language (OGNL) injection vulnerability, CVE-2021-26084 , and three Oracle WebLogic Server vulnerabilities, CVE-2020-14882 , CVE-2
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (August-October 2020)
Yue Guan
Lei Xu
Ken Hsu
Zhibin Zhang
Published: January 22, 2021
Malware
Trend Reports
Vulnerabilities
DDoS
Exploits
IoT
Network security trends
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823 , which were the most commonly exploited vulnerabilities in the wild in early summer 2020 , are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213 , have emerged and were being utilized at a constant and concern
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823, which were the most commonly exploited vulnerabilities in the wild in early summer 2020, are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213, have emerged and were being utilized at a constant and concerning rate as of fall 2020. To complicate matters, malicious actors are well aware that new exploits aren’t always needed to get the job done. Based on observations of malicious traffic for the designated three months, weaponized ThinkPHP vulnerabilities like CVE-2018-20062 and CVE-2019-908
http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14883
2020-10-21
Published
2021-11-03
Added to CISA KEV
Exploited in the wild