Rule Update
22-012 (March 8, 2022)
Publish date: March 08, 2022
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
H2 Database
1011316* - H2 Database Remote Code Execution Vulnerability (CVE-2022-23221)
Web Application PHP Based
1011319 - WordPress '404 to 301' Plugin Blind SQL Injection Vulnerability (CVE-2015-9323)
1011302 - WordPress 'Contact Form 7' plugin Unauthenticated Stored Cross-Site Scripting Vulnerability (CVE-2021-25080)
1011314 - WordPress 'Contact Form Check Tester' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24247)
1011305 - WordPress 'Domain Check' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24926)
1011325 - WordPress 'Perfect Survey' Plugin SQL Injection Vulnerability (CVE-2021-24762)
1011324 - WordPress 'WP User Frontend' Plugin SQL Injection Vulnerability (CVE-2021-25076)
1011313 - WordPress 'secure-copy-content-protection' Plugin SQL Injection Vulnerability (CVE-2021-24931)
1011298* - WordPress Core Post Slug Stored Cross-Site Scripting Vulnerability (CVE-2022-21662)
Web Client Common
1010182* - Google Chrome Type Confusion Vulnerability (CVE-2020-6418)
Web Client Internet Explorer/Edge
1011323 - Microsoft Internet Explorer Security Feature Bypass Vulnerability (CVE-2022-24502)
Web Server Common
1010099* - Elastic Kibana Timelion Prototype Pollution Vulnerability (CVE-2019-7609)
Web Server HTTPS
1011328 - Microsoft Defender for IOT Privilege Escalation Vulnerability (CVE-2022-23266)
Web Server Miscellaneous
1011304* - Atlassian Jira Reflected Cross-Site Scripting Vulnerability (CVE-2021-43942)
1011301* - Jenkins 'Matrix Project' Plugin Cross-Site Scripting Vulnerability (CVE-2022-20615)
Web Server Nagios
1011326 - Nagios XI AutoDiscovery Component Path Traversal Vulnerability (CVE-2021-37343)
Web Server SharePoint
1011318 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-42309)
1011310* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2022-22005)
Zoho ManageEngine
1011327 - Zoho ManageEngine ADManager Plus Unrestricted File Upload Vulnerability (CVE-2021-37926)
1011267* - Zoho ManageEngine Network Configuration Manager Command Injection Vulnerability (CVE-2021-43319)
1011254* - Zoho ManageEngine Network Configuration Manager SQL Injection Vulnerability (CVE-2021-41081)
1011317 - Zoho ManageEngine ServiceDesk Plus Stored Cross-Site Scripting Vulnerability (CVE-2021-46065)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
H2 Database
1011316* - H2 Database Remote Code Execution Vulnerability (CVE-2022-23221)
Web Application PHP Based
1011319 - WordPress '404 to 301' Plugin Blind SQL Injection Vulnerability (CVE-2015-9323)
1011302 - WordPress 'Contact Form 7' plugin Unauthenticated Stored Cross-Site Scripting Vulnerability (CVE-2021-25080)
1011314 - WordPress 'Contact Form Check Tester' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24247)
1011305 - WordPress 'Domain Check' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24926)
1011325 - WordPress 'Perfect Survey' Plugin SQL Injection Vulnerability (CVE-2021-24762)
1011324 - WordPress 'WP User Frontend' Plugin SQL Injection Vulnerability (CVE-2021-25076)
1011313 - WordPress 'secure-copy-content-protection' Plugin SQL Injection Vulnerability (CVE-2021-24931)
1011298* - WordPress Core Post Slug Stored Cross-Site Scripting Vulnerability (CVE-2022-21662)
Web Client Common
1010182* - Google Chrome Type Confusion Vulnerability (CVE-2020-6418)
Web Client Internet Explorer/Edge
1011323 - Microsoft Internet Explorer Security Feature Bypass Vulnerability (CVE-2022-24502)
Web Server Common
1010099* - Elastic Kibana Timelion Prototype Pollution Vulnerability (CVE-2019-7609)
Web Server HTTPS
1011328 - Microsoft Defender for IOT Privilege Escalation Vulnerability (CVE-2022-23266)
Web Server Miscellaneous
1011304* - Atlassian Jira Reflected Cross-Site Scripting Vulnerability (CVE-2021-43942)
1011301* - Jenkins 'Matrix Project' Plugin Cross-Site Scripting Vulnerability (CVE-2022-20615)
Web Server Nagios
1011326 - Nagios XI AutoDiscovery Component Path Traversal Vulnerability (CVE-2021-37343)
Web Server SharePoint
1011318 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-42309)
1011310* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2022-22005)
Zoho ManageEngine
1011327 - Zoho ManageEngine ADManager Plus Unrestricted File Upload Vulnerability (CVE-2021-37926)
1011267* - Zoho ManageEngine Network Configuration Manager Command Injection Vulnerability (CVE-2021-43319)
1011254* - Zoho ManageEngine Network Configuration Manager SQL Injection Vulnerability (CVE-2021-41081)
1011317 - Zoho ManageEngine ServiceDesk Plus Stored Cross-Site Scripting Vulnerability (CVE-2021-46065)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Featured Stories
- Kong API Gateway Misconfigurations: An API Gateway Security Case StudyTools that aggregate access into multiple different environments, such as API gateways, pose a security risk for all these environments upon breach. In this article, we continue our journey through the security issues of the API Gateway landscape. Our new research focuses on another popular API gateway — Kong.Read more
- Open RAN: Attack of the xAppsThis article discusses two O-RAN vulnerabilities that attackers can exploit. One vulnerability stems from insufficient access control, and the other arises from faulty message handlingRead more
- A Closer Exploration of Residential Proxies and CAPTCHA-Breaking ServicesThis article, the final part of a two-part series, focuses on the details of our technical findings and analyses of select residential proxies and CAPTCHA-solving services.Read more
- How Residential Proxies and CAPTCHA-Solving Services Become Agents of AbuseThis article, the first of a two-part series, provides insights on how abusers and cybercriminals use residential proxies and CAPTCHA-solving services to enable bots, scrapers, and stuffers, and proposes security countermeasures for organizations.Read more