Deep Security Center

Page 1 of 43:
1
2
3
4
5
6
7
8
9
10
...
43

RULE UPDATE: 22-048 (September 30, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Web Server HTTPS
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473 and ZDI-CAN-18802)
1011548 - Microsoft Exchange Server Remote Code Execution Vulnerability (ZDI-CAN-18333)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

RULE UPDATE: 22-047 (September 27, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Atlassian Bitbucket
1011540 - Atlassian Bitbucket Server and Data Center Remote Command Execution Vulnerability (CVE-2022-36804)

DCERPC Services - Client
1011517* - Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (DogWalk) Over SMB (CVE-2022-34713)

HP Intelligent Management Center (IMC)
1011534* - Apache OFBiz Server-Side Template Injection Vulnerability (CVE-2022-25813)

Trend Micro OfficeScan
1011539 - Trend Micro Apex One And OfficeScan Authentication Bypass Vulnerability (CVE-2022-40144)
1011543 - Trend Micro Apex One And OfficeScan Information Disclosure Vulnerability (CVE-2022-40141)

Web Application PHP Based
1011528* - WordPress 'Simple File List' Plugin Directory Traversal Vulnerability (CVE-2022-1119)

Web Client Common
1011544 - Adobe Acrobat And Reader Buffer Overflow Vulnerability (CVE-2011-0591)

Web Server Common
1011538 - Apache JSPWiki Reflected Cross Site Scripting Vulnerability (CVE-2022-27166)
1010175* - Cross-Site Scripting (XSS) Decoder

Web Server Miscellaneous
1004118* - Apache ActiveMQ Source Code Information Disclosure Vulnerability
1011535* - Jenkins 'Plot' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2022-34783)
1003505* - Microsoft .Net Framework Null Byte Injection Vulnerability
1002984* - Oracle BEA WebLogic Server Apache Connector Buffer Overflow

Web Server SharePoint
1011541 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2022-35823)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

RULE UPDATE: 22-046 (September 20, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

HP Intelligent Management Center (IMC)
1011534 - Apache OFBiz Server-Side Template Injection Vulnerability (CVE-2022-25813)

IPSec-IKE
1011536 - Microsoft Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (CVE-2022-34721)

Unix SSH
1011515* - Detected SSH Client Traffic - 1 (ATT&CK T1021.004)

Web Application PHP Based
1011537 - WordPress 'BackupBuddy' Plugin Directory Traversal Vulnerability (CVE-2022-31474)

Web Application Ruby Based
1011243* - Grafana Path Traversal Vulnerability (CVE-2021-43798)

Web Server Miscellaneous
1011535 - Jenkins 'Plot' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2022-34783)

Zoho ManageEngine
1011527* - Zoho ManageEngine Multiple Products 'getDNSResolveOption' Command Injection Vulnerability (CVE-2022-37024)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

RULE UPDATE: 22-045 (September 14, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

There are no new or updated Deep Packet Inspection Rules in this Security Update.

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

1011241* - Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228)

RULE UPDATE: 22-044 (September 13, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Apache Spark
1011499* - Apache Spark Command Injection Vulnerability (CVE-2022-33891)

Directory Server LDAP
1011531 - Microsoft Windows Active Directory Certificate Services Privilege Escalation Vulnerability (CVE-2022-34691)
1011246* - Microsoft Windows Active Directory Domain Services Elevation of Privilege Vulnerability Over LDAP (CVE-2021-42278)

Web Application Common
1011364* - Dolibarr ERP And CRM Code Injection Vulnerability (CVE-2022-0819)

Web Server HTTPS
1011525* - Zimbra Collaboration Cross-Site Scripting Vulnerability (CVE-2022-24682) - Server

Zoho ManageEngine
1011527* - Zoho ManageEngine Multiple Products 'getDNSResolveOption' Command Injection Vulnerability (CVE-2022-37024)
1011526* - Zoho ManageEngine Multiple Products 'getNmapInitialOption' Command Injection Vulnerability (CVE-2022-38772)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

1011241* - Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228)
1011453* - Microsoft Windows WMI Events - 1

RULE UPDATE: 22-043 (September 6, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services - Client
1011517 - Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (DogWalk) Over SMB (CVE-2022-34713)

DNS Client
1011523 - Identified Usage of dnscat2 Tool

Web Application PHP Based
1011528 - WordPress 'Simple File List' Plugin Directory Traversal Vulnerability (CVE-2022-1119)

Web Client Common
1011350* - Zimbra Collaboration Cross-Site Scripting Vulnerability (CVE-2022-24682) - Client

Web Server HTTPS
1011525 - Zimbra Collaboration Cross-Site Scripting Vulnerability (CVE-2022-24682) - Server

Web Server IIS
1003671* - Microsoft ASP.NET Remote Unauthenticated Denial Of Service Vulnerability (CVE-2009-1536)

Web Server Miscellaneous
1011521* - Atlassian Jira Server and Data Center Reflected Cross Site Scripting Vulnerability (CVE-2022-36801)

Webmin
1011520* - Webmin Remote Code Execution Vulnerability (CVE-2022-36446)

Zimbra Proxy
1011514* - Zimbra Collaboration CRLF Injection Vulnerability (CVE-2022-27924)

Zoho ManageEngine
1011527 - Zoho ManageEngine Multiple Products 'getDNSResolveOption' Command Injection Vulnerability (CVE-2022-37024)
1011526 - Zoho ManageEngine Multiple Products 'getNmapInitialOption' Command Injection Vulnerability (CVE-2022-38772)
1011522* - Zoho ManageEngine Multiple Products 'getUserAPIKey' Authentication Bypass Vulnerability (CVE-2022-36923)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)

RULE UPDATE: 22-042 (August 30, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Oracle E-Business Suite Web Interface
1011516* - Oracle E-Business Suite Unauthorized Access Vulnerability (CVE-2022-21500)

Web Client Common
1011350 - Zimbra Collaboration Cross-site Scripting Vulnerability (CVE-2022-24682)

Web Server Common
1011510* - Pandora FMS Authenticated Remote Code Execution Vulnerability (CVE-2020-5844)

Web Server IIS
1006434* - Microsoft IIS Directory Traversal Vulnerability
1000101* - Microsoft IIS Malformed HTTP Request DoS Vulnerability

Web Server Miscellaneous
1011521 - Atlassian Jira Server and Data Center Reflected Cross Site Scripting Vulnerability (CVE-2022-36801)

Webmin
1011520 - Webmin Remote Code Execution Vulnerability (CVE-2022-36446)

Zimbra Proxy
1011514 - Zimbra Collaboration CRLF Injection Vulnerability (CVE-2022-27924)

Zoho ManageEngine
1011522 - Zoho ManageEngine Multiple Products 'getUserAPIKey' Authentication Bypass Vulnerability (CVE-2022-36923)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

RULE UPDATE: 22-041 (August 23, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Oracle E-Business Suite Web Interface
1011516 - Oracle E-Business Suite Unauthorized Access Vulnerability (CVE-2022-21500)

Remote Desktop Protocol Server
1003716* - Identified Too Many Remote Desktop Protocol (RDP) Connection Request

Unix SSH
1011515 - Detected SSH Client Traffic - 1

Web Application Ruby Based
1011509* - Grafana Stored Cross-Site Scripting Vulnerability (CVE-2022-31097)

Web Application Tomcat
1003954* - Apache Tomcat Directory Traversal Weakness

Web Client Common
1011518 - Foxit PDF Reader And Editor Multiple Security Vulnerabilities

Web Server HTTPS
1011519 - Node.js HTTP Request Smuggling Attack (CVE-2022-32214)

Zimbra Admin Console Ports
1011513* - Zimbra Collaboration Multiple Directory Traversal Vulnerabilities (CVE-2022-27925 & CVE-2022-37042)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

1011453* - Microsoft Windows WMI Events - 1

RULE UPDATE: 22-040 (August 16, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Microsoft Office
1011504 - Microsoft Excel Memory Corruption Vulnerability (CVE-2005-4131)

Web Application Common
1011490* - Zoho ManageEngine ADAudit Plus XML External Entity Injection Vulnerability (CVE-2022-28219)

Web Application PHP Based
1007459* - Drupal XRDS Document Denial Of Service Vulnerability (CVE-2014-5267)
1011170* - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)

Web Client Common
1011500 - Identified Download of Python Reverse Shell Payload Over HTTP

Web Server Common
1011510 - Pandora FMS Authenticated Remote Code Execution Vulnerability (CVE-2020-5844)

Web Service HP SiteScope
1005233* - HP SiteScope API Preferences Security Bypass Vulnerability (CVE-2012-3261)

Zimbra Admin Console Ports
1011513 - Zimbra Collaboration Multiple Directory Traversal Vulnerabilities (CVE-2022-27925 & CVE-2022-37042)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

1011512 - Microsoft DFS Server Activity

RULE UPDATE: 22-039 (August 12, 2022)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Web Client Common
1011511 - Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (DogWalk) (CVE-2022-34713)

Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

Featured Stories

View All

$Cloud-native apps$
Abusing Argo CD, Helm, and Artifact Hub: An Analysis of Supply Chain Attacks in Cloud-Native Applications
We provide an overview of cloud-native tools and examine how cybercriminals can exploit their vulnerabilities to launch supply chain attacks.
Read more
$Trends and Shifts in the Underground N-Day Exploit Market$
Trends and Shifts in the Underground N-Day Exploit Market
Our two-year research provides insights into the life cycle of exploits, the types of exploit buyers and sellers, and the business models that are reshaping the underground exploit market.
Read more
$the nightmares of patch management the status quo and beyond$
The Nightmares of Patch Management: The Status Quo and Beyond
We discuss the challenges that organizations face in managing endpoint and server patches.
Read more
$Weak Parts Supply Chain$
Identifying Weak Parts of a Supply Chain
Malicious attacks have consistently been launched on weak points in the supply chain. Like all attacks, these will evolve into more advanced forms. Software development, with multiple phases that could be placed at risk, is particularly vulnerable.
Read more