Tageszusammenfassung - 25.05.2023

End-of-Day report

Timeframe: Mittwoch 24-05-2023 18:00 - Donnerstag 25-05-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a


Hackers target 1.5M WordPress sites with cookie consent plugin exploit

Ongoing attacks are targeting an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in a WordPress cookie consent plugin named Beautiful Cookie Consent Banner with more than 40,000 active installs.


A new OAuth vulnerability that may impact hundreds of online services

This post details issues identified in Expo, a popular framework used by many online services to implement OAuth (as well as other functionality). The vulnerability in the expo-auth-session library warranted a CVE assignment - CVE-2023-28131. Expo created a hotfix within the day that automatically provided mitigation, but Expo recommends that customers update their deployment to deprecate this service to fully remove the risk (see the Expo security advisory on the topic).


codeexplain.vim: A nvim plugin Powered by GPT4ALL for Real-time Code Explanation and Vulnerability Detection (no internet necessary)

codeexplain.nvim is a NeoVim plugin that uses the powerful GPT4ALL language model to provide on-the-fly, line-by-line explanations and potential security vulnerabilities for selected code directly in your NeoVim editor. Its like having your personal code assistant right inside your editor without leaking your codebase to any company.


Google Authenticator: Geräteverschlüsselung versprochen, aber nicht geliefert

Google hat dem Authenticator eine Backup-Funktion spendiert, die Geheimnisse jedoch nicht verschlüsselt. Ein Update soll das ändern. Das tut es aber nicht.


Buhti: New Ransomware Operation Relies on Repurposed Payloads

Attackers use rebranded variants of leaked LockBit and Babuk ransomware payloads but use own custom exfiltration tool.


Mercenary mayhem: A technical analysis of Intellexas PREDATOR spyware

Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).


Abusing Web Services Using Automated CAPTCHA-Breaking Services and Residential Proxies

This blog entry features three case studies that show how malicious actors evade the antispam, antibot, and antiabuse measures of online web services via residential proxies and CAPTCHA-breaking services.



Teils kritische Sicherheitslücken in Mitel MiVoice Connect

In Mitels MiVoice Connect und Connect Mobility Router klaffen teils kritische Sicherheitslücken. Updates zum Schließen stehen bereit.


Kritisches Sicherheitsupdate (24. Mai 2023) für alle Zyxel-Firewall-Produkte - Angriffe laufen bereits

Der taiwanesische Hersteller Zyxel hat ein sehr kritisches Security Update für sämtliche Security Produkte veröffentlicht. Die Sicherheitswarnung gibt an, dass gleich mehrere Buffer Overflow-Schwachstellen (CVE-2023-33009, CVE-2023-33010) betroffen seien.


Kritische Sicherheitslücke mit Höchstwertung bedroht GitLab

Es gibt eine wichtiges Sicherheitsupdate für die Versionsverwaltung GitLab. Entwickler sollten jetzt reagieren.


Security updates for Thursday

Security updates have been issued by Debian (python2.7), Fedora (maradns), Red Hat (devtoolset-12-binutils, go-toolset and golang, httpd24-httpd, jenkins and jenkins-2-plugins, rh-ruby27-ruby, and sudo), Scientific Linux (git), Slackware (texlive), SUSE (cups-filters, poppler, texlive, distribution, golang-github-vpenso-prometheus_slurm_exporter, kubernetes1.18, kubernetes1.23, openvswitch, rmt-server, and ucode-intel), and Ubuntu (ca-certificates, calamares-settings-ubuntu, Jhead, libhtml-stripscripts-perl, and postgresql-10, postgresql-12, postgresql-14, postgresql-15).


Wacom Tablet Driver installer for macOS vulnerable to improper link resolution before file access


D-Link D-View 8 : v2.0.1.27 and below : TrendMicro (ZDI) Reported Multiple Vulnerabilities


Autodesk: Multiple Vulnerabilities in PSKernel component used by specific Autodesk products


Autodesk: Privilege Escalation Vulnerability in the Autodesk Installer Software


F5: K000134768 : Linux kernel vulnerability CVE-2022-4378


F5: K000134770 : Linux kernel vulnerability CVE-2022-42703


Moxa MXsecurity Series


Nextcloud: Blind SSRF in the Mail app on avatar endpoint


Nextcloud: Contacts - PHOTO svg only sanitized if mime type is all lower case


Nextcloud: Error in calendar when booking an appointment reveals the full path of the website


Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.


IBM HTTP Server is vulnerable to information disclosure due to IBM GSKit (CVE-2023-32342)


IBM Planning Analytics Workspace has addressed a vulnerability in SnakeYaml (CVE-2022-1471)


Vulnerability from log4j-1.2.16.jar affect IBM Operations Analytics - Log Analysis (CVE-2023-26464)


IBM App Connect Enterprise Certified Container IntegrationServer operands that run Designer flows is vulnerable to arbitrary code execution due to [CVE-2022-37614]


IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2023-2251]


A vulnerability in Etcd-io could affect IBM CICS TX Standard [CVE-2021-28235]


A vulnerability in Etcd-io could affect IBM CICS TX Advanced [CVE-2021-28235]


IBM App Connect Enterprise Certified Container DesignerAuthoring operands is vulnerable to arbitrary code execution due to [CVE-2023-30547]


Due to the use of Apache spring-web, IBM ECM Content Management Interoperability Services (CMIS) is affected by remote code execution (RCE) security vulnerability CVE-2016-1000027


Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Go