U.S. CISA adds Palo Alto Networks Expedition bugs to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
U.S. CISA adds Craft CMS and Palo Alto Networks PAN-OS flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
Attackers are chaining flaws to breach Palo Alto Networks firewalls
60
60
60
60
60
60
60
60
60
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
82
60
60
60
60
60
60
60
Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
60
60
60
U.S. CISA adds Palo Alto Expedition, Android, CyberPanel and Nostromo nhttpd bugs to its Known Exploited Vulnerabilities catalog
60
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
Network Security Trends: November 2021 to January 2022
60
Network Security Trends: August
60
Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022
60
60
60