Rule Update
19-029 (May 21, 2019)
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1006906* - Identified Usage Of PsExec Command Line Tool
HP Intelligent Management Center Dbman
1009043 - HPE Intelligent Management Center 'dbman' FileTrans Arbitrary File Write Vulnerability (CVE-2017-5822)
1009637 - HPE Intelligent Management Center 'dbman' Stack Buffer Overflow Vulnerability (CVE-2018-7115)
HP OpenView Network Node Manager Web
1004280* - HP OpenView NNM ovwebsnmpsrv.exe Command Line Argument Buffer Overflow
Remote Desktop Protocol Server
1009749* - Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)
Web Application Common
1009687 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10218) - 1
1009691 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10220) - 1
1009423 - ImageMagick Multiple Security Vulnerabilities (Server) - 26
Web Client Common
1009234 - Foxit Reader Multiple Security Vulnerabilities - 7
1009686 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10218)
1009690 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10220)
1009422 - ImageMagick Multiple Security Vulnerabilities (Client) - 26
1009539* - Microsoft Windows Multiple GDI Information Disclosure Vulnerabilities (Feb 2019)
1009582* - Microsoft Windows Win32k Elevation Of Privilege Vulnerability (CVE-2019-0808)
1009698 - Microsoft Word Information Disclosure Vulnerability (CVE-2019-0561)
Web Client Internet Explorer/Edge
1009411* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617)
1009463* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0539)
1009464* - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2019-0541)
Web Server SAP
1009715* - SAP Gateway 'gw/acl_mode' Command Injection Vulnerability (10KBLAZE)
Zoho ManageEngine
1009399 - Zoho ManageEngine OpManager 'oputilsServlet' Authentication Bypass (CVE-2018-17283)
Integrity Monitoring Rules:
1007295* - Application - chrony
1003168* - Unix - Open Port Monitor
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1006906* - Identified Usage Of PsExec Command Line Tool
HP Intelligent Management Center Dbman
1009043 - HPE Intelligent Management Center 'dbman' FileTrans Arbitrary File Write Vulnerability (CVE-2017-5822)
1009637 - HPE Intelligent Management Center 'dbman' Stack Buffer Overflow Vulnerability (CVE-2018-7115)
HP OpenView Network Node Manager Web
1004280* - HP OpenView NNM ovwebsnmpsrv.exe Command Line Argument Buffer Overflow
Remote Desktop Protocol Server
1009749* - Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)
Web Application Common
1009687 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10218) - 1
1009691 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10220) - 1
1009423 - ImageMagick Multiple Security Vulnerabilities (Server) - 26
Web Client Common
1009234 - Foxit Reader Multiple Security Vulnerabilities - 7
1009686 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10218)
1009690 - Ghostscript Remote Code Execution Vulnerability (CVE-2016-10220)
1009422 - ImageMagick Multiple Security Vulnerabilities (Client) - 26
1009539* - Microsoft Windows Multiple GDI Information Disclosure Vulnerabilities (Feb 2019)
1009582* - Microsoft Windows Win32k Elevation Of Privilege Vulnerability (CVE-2019-0808)
1009698 - Microsoft Word Information Disclosure Vulnerability (CVE-2019-0561)
Web Client Internet Explorer/Edge
1009411* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617)
1009463* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0539)
1009464* - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2019-0541)
Web Server SAP
1009715* - SAP Gateway 'gw/acl_mode' Command Injection Vulnerability (10KBLAZE)
Zoho ManageEngine
1009399 - Zoho ManageEngine OpManager 'oputilsServlet' Authentication Bypass (CVE-2018-17283)
Integrity Monitoring Rules:
1007295* - Application - chrony
1003168* - Unix - Open Port Monitor
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Featured Stories
When AI Becomes a Zero-Day Machine: What Public Sector Organizations Need to KnowClaude Mythos Preview shows how AI can rapidly discover and weaponize zero-day vulnerabilities—transforming once human-scale threats into machine-speed attacks. As these capabilities spread, public sector organizations must rely on trusted, proactive defenders like TrendAI™ ZDI to stay ahead of an AI-driven threat landscape.Read more
Hunt Them All: An AI-Powered Vulnerability Sweep of 19,000 MCP ServersIn this research, we analyzed over 19,000 open-source MCP server repositories to uncover how much AI-generated code they contain and how many harbor exploitable vulnerabilities.Read more
Update on Exposed MCP Servers: The Threat Widens to the CloudExposed Model Context Protocol (MCP) servers have become powerful vectors for cloud attacks, enabling threat actors to not only access sensitive data but also take control of the cloud services themselves.Read more
Old Vulnerabilities, New AI Era, Amplified Risk: How Outdated Flaws Continue to Fuel the N-Day Exploit MarketEven as AI adoption accelerates, old exploits remain overlooked weaknesses. Underground trends show a renewed demand for exploits, with cybercriminals relying on aging but still effective vulnerabilities. We examine this blind spot and why long-standing issues need to be addressed.Read more