Security researchers have discovered a critical remote code execution vulnerability in the popular Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers.

By exploiting this vulnerability, it is possible to perform an RCE attack when namespace value isn't set for a result defined in underlying configurations and in the same time, its upper action(s) configurations have no or wildcard namespace. The same possibility when using url tag which doesn’t have value and action set and in the same time, its upper action(s) configurations have no or wildcard namespace.

Cybercriminals are preparing to carry out a highly choreographed, global fraud scheme known as an “ATM cash-out,” in which crooks hack a bank or payment card processor and use cloned cards at cash machines around the world to fraudulently withdraw millions of dollars in just a few hours. One of the oldest co-operative banks of Pune, India, Cosmos co-operative bank has become the latest victim of cyber attack. The ATM switch system of the bank was hacked and INR 94.42 crore was siphoned off between August 11 and August 13.

Another Drupal Remote Code Execution vulnerability has been discovered and was made public on April 25th, 2018, making this the 3rd vulnerability and 2nd “Highly Critical Vulnerability” to be disclosed in the last 30 days for the Drupal Core. The vulnerability (CVE-2018-7602) allows an attacker to exploit multiple attack vectors of the subsystems of Drupal 7.x and 8.x, resulting in a complete compromise of the site. There are reports that this vulnerability is currently being exploited in the wild.

A remote code execution vulnerability has been discovered and was made public on March 28th 2018, exist within multiple subsystems of Drupal 7.x and Drupal 8.x, potentially allowing attackers to exploit multiple attack vectors on a site running Drupal. This will result in a complete compromise of the site. The vulnerability has been given the CVE identification of CVE-2018-7600. As of the writing of this alert, Drupal has not identified a public exploit in the wild yet, but it is safe to say that due the criticality of the vulnerability, users should expect possible exploits to be developed and utilised maliciously. Hence, application of the now-released fix is gravely recommended.

It has been confirmed that a newly discovered flaws in Intel Processors at the hardware level could allow programs to steal data from running applications. In a typical case, programs are not allowed to read data from other programs. However a malware exploiting these new vulnerabilities can get data from the memory of currently running programs. This includes confidential information such as business-critical documents, passwords, login details, encryption keys, etc. The vulnerabilities have been named Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715).

WordPress is an very popular open source software used by bloggers and millions of websites. A new security update, WordPress 4.8.3 is released, which addresses a potential SQL injection vulnerability. This update was released on October 31st and is available for public download.

BlueBorne is an attack vector can leverage Bluetooth connections to penetrate and take complete control over targeted devices. BlueBorne affects ordinary computers, mobile phones, and the expanding realm of IoT devices. The attack does not require the targeted device to be paired to the attacker’s device, or even to be set on discoverable mode.

A new Ransomware variant with worm like capabilities has infected many organizations around the world. The media is calling it "Petya" but it is not similar to the Petya variants seen before. In the propagation process, the malware enumerates all network adapters, all known server names via NetBIOS and also retrieves the list of current DHCP leases, if available. Each and every IP on the local network and each server found is checked for open TCP ports 445 and 139. Those machines that have these ports open are then attacked with one of the methods described above.

Drupal has released an advisory to address several vulnerabilities in Drupal versions 7.x and 8.x. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. (Advisory ID: DRUPAL-SA-CORE-2017-003)

Ransomware attacks dubbed as “WannaCry” started to spread around the world on the 12th May 2017. In these attacks, data is encrypted with the extension “.WCRY” added to the file names. According to the reports, this attack initiated through an SMBv1 remote code execution vulnerability in Microsoft Windows code-named “EternalBlue”. The exploit “EternalBlue” has been made available on the internet through the Shadowbrokers dump on 14th April 2017.
Microsoft released security patch updates for this vulnerability on 14th March 2017 in Microsoft Security Bulletin MS17-010.

footerimage

Member of

logo apcertfirst logo-2

Collaborated with

apwg2ICTA logo2ack cymru

Our Partners
lanka-certify-logoDark-Lab-Logo2contact