Network Attack Trends: Internet of Threats (November 2020
- CVEs
- CVE-2020-28188CVE-2020-17519CVE-2020-29227CVE-2017-17411CVE-2014-8244CVE-2019-16920CVE-2019-19597CVE-2019-13372CVE-2018-19986CVE-2015-2051CVE-2013-7389CVE-2013-1599CVE-2013-7471CVE-2018-20062CVE-2019-9082CVE-2020-13671CVE-2019-6340CVE-2018-9205CVE-2018-7600CVE-2018-7602CVE-2014-3704CVE-2020-27615CVE-2020-25213CVE-2020-5766CVE-2020-12800CVE-2020-11738CVE-2020-11732CVE-2019-8942CVE-2019-9881CVE-2019-9879CVE-2019-14205CVE-2019-9880CVE-2018-9118CVE-2018-7422CVE-2020-17496CVE-2020-12720CVE-2019-16759CVE-2015-7808CVE-2020-23972CVE-2018-7482CVE-2018-7314CVE-2018-6605CVE-2017-5215CVE-2016-8869CVE-2015-8562CVE-2017-9841CVE-2017-12542CVE-2014-2617CVE-2018-14847CVE-2020-0796CVE-2020-1350CVE-2020-1472CVE-2019-0606CVE-2019-0708CVE-2017-0147CVE-2017-0144CVE-2015-1635CVE-2020-17530CVE-2020-13942CVE-2020-11975CVE-2020-1957CVE-2019-17554CVE-2019-0193CVE-2019-0232CVE-2019-0192
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1635 | Unauthenticated Remote Code Execution in Microsoft HTTP.sys (MS15-034) | — | 100% | KEV | — KEV |
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2016-8869 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain… | 9.8 | 97% | PoC ×2 | |
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices | 8.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2017-0147 | Information Disclosure in Microsoft Windows SMBv1 Server (CVE-2017-0147) | 7.5 | 100% | KEVRansomwarePoC ×5 | KEV |
| CVE-2017-12542 | A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found | 10.0 | 99% | PoC | |
| CVE-2017-17411 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0 | 9.8 | 88% | PoC ×3 | |
| CVE-2017-5215 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a "safe file extension" protection… | 9.8 | 4% | PoC | |
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php | 9.8 | 100% | KEV | KEV |
| CVE-2018-14847 | Directory Traversal in MikroTik RouterOS Winbox Interface (Unauthenticated File Read) | 9.1 | 96% | KEVPoC ×7 | KEV |
| CVE-2018-19986 | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1… | 9.8 | 42% | PoC | |
| CVE-2018-20062 | Unauthenticated Remote Code Execution in ThinkPHP-based noneCms 1.3 | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2018-6605 | SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText… | 9.8 | 58% | PoC | |
| CVE-2018-7314 | SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429 | 9.8 | 58% | PoC | |
| CVE-2018-7422 | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the… | 7.5 | 62% | PoC ×2 | |
| CVE-2018-7482 | The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by… | 7.5 | 2% | ||
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2018-7602 | Drupal Core Remote Code Execution Vulnerability | 9.8 | 99% | KEVRansomwarePoC ×2 | KEV |
| CVE-2018-9118 | exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a . | 7.5 | 46% | PoC ×2 | |
| CVE-2018-9205 | Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path | 7.5 | 55% | PoC ×2 | |
| CVE-2019-0192 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request | 9.8 | 78% | ||
| CVE-2019-0193 | Code Injection RCE in Apache Solr DataImportHandler (DIH) | 7.2 | 84% | KEV | KEV |
| CVE-2019-0232 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is… | 8.1 | 100% | ||
| CVE-2019-0606 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption… | 7.5 | 11% | ||
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-13372 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… | 9.8 | 82% | PoC | |
| CVE-2019-14205 | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via… | 7.5 | 63% | PoC ×3 | |
| CVE-2019-16759 | Pre-Authentication Remote Code Execution in vBulletin 5.x | 9.8 | 100% | KEVPoC ×9 | KEV |
| CVE-2019-16920 | Command Injection in Multiple D-Link Routers Enables Full Device Compromise | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2019-17554 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities | 5.5 | 12% | PoC ×2 | |
| CVE-2019-19597 | D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH… | 8.8 | 21% | PoC | |
| CVE-2019-6340 | Deserialization RCE in Drupal 8 Core Web Services (CVE-2019-6340) | 8.1 | 92% | KEVPoC ×2 | KEV |
| CVE-2019-8942 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string… | 8.8 | 83% | PoC ×6 | |
| CVE-2019-9082 | Unauthenticated RCE in ThinkPHP < 3.2.4 (Open Source BMS, ZzzCMS zzzphp) | 8.8 | 97% | KEVPoC ×3 | KEV |
| CVE-2019-9879 | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed | 9.8 | 46% | PoC ×3 | |
| CVE-2019-9880 | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress | 9.1 | 35% | PoC ×3 | |
| CVE-2019-9881 | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment'… | 5.3 | 18% | PoC ×3 | |
| CVE-2020-0796 | Unauthenticated RCE in Microsoft SMBv3 (SMBGhost) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2020-11732 | The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download | 7.5 | 5% | ||
| CVE-2020-11738 | Unauthenticated Directory Traversal File Read in WordPress Duplicator Plugin | 7.5 | 98% | KEVPoC ×3 | KEV |
| CVE-2020-11975 | Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the… | 9.8 | 30% | ||
| CVE-2020-12720 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control | 9.8 | 89% | ||
| CVE-2020-12800 | The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting… | 9.8 | 79% | PoC | |
| CVE-2020-1350 | Wormable Unauthenticated RCE in Microsoft Windows DNS Server | 10.0 | 97% | KEV | KEV |
| CVE-2020-13671 | Unrestricted File Upload via Filename Sanitization Flaw in Drupal Core | 8.8 | 36% | KEV | KEV |
| CVE-2020-13942 | It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint | 9.8 | 68% | PoC | |
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers | 5.5 | 99% | KEVRansomwarePoC | KEV |
| CVE-2020-17496 | Unauthenticated Remote Command Execution in vBulletin 5.5.4-5.6.2 | 9.8 | 87% | KEVPoC ×2 | KEV |
| CVE-2020-17519 | Unauthenticated Arbitrary File Read in Apache Flink JobManager REST Interface | 7.5 | 98% | KEVPoC | KEV |
| CVE-2020-17530 | Forced OGNL Evaluation RCE in Apache Struts 2.0.0-2.5.25 | 9.8 | 96% | KEV | KEV |
| CVE-2020-1957 | Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass | 9.8 | 23% | ||
| CVE-2020-23972 | In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload… | 7.5 | 31% | PoC | |
| CVE-2020-25213 | Unauthenticated RCE in WordPress File Manager (wp-file-manager) Plugin | 9.8 | 97% | KEVPoC ×5 | KEV |
| CVE-2020-27615 | The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip | 9.8 | 53% | PoC | |
| CVE-2020-28188 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php… | 9.8 | 96% | PoC ×2 | |
| CVE-2020-29227 | An issue was discovered in Car Rental Management System 1.0 | 9.8 | 17% | PoC | |
| CVE-2020-5766 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a… | 7.5 | 7% | PoC |
From the original article
7 min read at unit42.paloaltonetworks.com
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan.
By Lei Xu, Yue Guan, Vaibhav Singhal · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.