21-048 (November 2, 2021)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)


Memcached
1011098* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)


Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)


Web Application PHP Based
1011193 - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)


Web Client Common
1010806* - Identified Directory Traversal Attack In HTTP Response Headers
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)


Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)


Web Server HTTPS
1011196 - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190 - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)


Web Server Nagios
1011191* - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)


Zoho ManageEngine
1011188* - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)


Zoho ManageEngine ADSelfService Plus
1011194 - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)