Tag: Vulnerability

Microsoft Exchange ProxyShell Attack
Microsoft Exchange ProxyShell Attack Detection

Thousands of Microsoft Exchange servers remain vulnerable to ProxyShell remote code execution vulnerabilities despite the patches issued in April-May. To make things even worse, security researchers are observing a significant spike in scans for vulnerable Exchange servers, after the technical overview of the ProxyShell attack was revealed at the Black Hat conference on August 4-5, […]

Read More
Pulse Connect Secure Patch Bypass
CVE-2021-22937 Detection: Patch Bypass Vulnerability in Pulse Connect Secure

Ivanti has addressed a critical security hole (CVE-2021-22937) that affects its Pulse Connect Secure VPNs. The flaw is a bypass of the patch issued in October last year to mitigate the CVE-2020-8260, a notorious bug that allows malicious admins to execute arbitrary code remotely with root privileges. CVE-2021-22937 Description According to the in-depth inquiry by […]

Read More
HiveNightmare (CVE-2021-36934) detection
Detect HiveNightmare (CVE-2021-36934) Exploitation Attempts

July 2021 proceeds to be a really hot and tough month in terms of the loud cybersecurity events. While the world of cyber is still recovering from PrintNighmare vulnerability (CVE-2021-1675), Kaseya supply chain attack, and SolarWinds Serv-U zero-day (CVE-2021-35211), Windows has officially announced a new notorious flaw within its products. A recently disclosed HiveNightmare (aka […]

Read More
SolarWinds Serv-U Zero-Day (CVE-2021-35211) Detection

A  critical zero-day bug (CVE-2021-35211), existing in SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP products, has been repeatedly exploited in the wild by a China-baked hacker collective, Microsoft reveals. The flaw provides threat actors with the ability to execute arbitrary code remotely and reach the full system compromise. CVE-2021-35211 Description According to […]

Read More
Detect PrintNightmare (CVE-2021-1675) Exploitation Attempts

A notorious remote code execution (RCE) bug in Windows Print Spooler allows attackers to achieve full system compromise on the unpatched instances. The vulnerability, dubbed PrintNightmare (CVE-2021-1675), was initially rated as a low-severity issue that enables privilege escalation to admin on the targeted hosts. However, after deep-dive research by experts who discovered the potential for […]

Read More
Detect Wormable RCE Vulnerability (CVE-2021-31166) in Windows HTTP.sys

Microsoft has recently fixed a highly critical bug (CVE-2021-31166), which enables remote code execution with kernel rights on the machines running Windows 10 and Windows Server. The vendor warns that this flaw is wormable and could self-propagate across multiple servers inside the organizational network to cause maximum harm. The Proof of Concept (PoC) exploit has […]

Read More
Detecting FragAttacks: Overview of Newly Discovered WiFi Flaws

Yet another time security practitioners should brace themselves and check their coffee supplies due to a set of recently identified vulnerabilities in the Wi-Fi standard. Collectively called FragAttacks, these flaws affect nearly all wireless-enabled devices and allow adversaries to take control over the vulnerable systems to intercept secret information. Mathy Vanhoef, a security expert who […]

Read More
Detect Privilege Escalation Vulnerabilities (CVE-2021-21551) in Dell BIOS Driver

Dell computers worldwide are potentially vulnerable to attacks due to high-severity flaws introduced back in 2009. According to experts, a set of five issues tracked together as CVE-2021-21551 affects Dell DBUtil driver and allows adversaries to gain kernel-mode privileges on the affected machines. Although CVE-2021-21551 has been present in the driver for more than a […]

Read More
Ivanti Patches Critical Pulse Connect Secure Flaws Under Active Exploitation

On May 3, 2021, Ivanti issued a security update addressing highly critical security holes in its Pulse Connect Secure SSL VPN appliance. The flaws have been reportedly used by APT actors to target government agencies, critical infrastructure objects, and private firms across the U.S. Pulse Connect Secure Vulnerabilities According to the CISA security alert from […]

Read More
Pulse Connect Secure Vulnerabilities Are Exploited in Ongoing Attacks Against High-Profile Targets

On April 20, 2021, US-CERT issued an alert warning about an ongoing malicious campaign abusing vulnerable Pulse Connect Secure products to attack organizations across the US. The campaign broke forth in June 2020 and involved multiple security incidents affecting government agencies, critical infrastructure assets, and private sector organizations. Threat actors rely on a set of […]

Read More