Whitepaper Name Goes
trustwave.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
18 CVEs- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
- CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution VulnerabilityVMware · Spring FrameworkKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports99.6%Top 0.05%86.0priority
- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reports99.9%Top 0.03%86.0priority
- CVE-2022-44698Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityMicrosoft · DefenderKEVRansomwareMedium · 5.4T1204.002Malicious FileT1211Exploitation for Stealth1 report76.3%Top 0.46%75.6priority
- CVE-2023-21932Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications…Oracle Corporation · Hospitality OPERA 5 Property ServicesHigh · 7.21 report45.0%Top 1.2%64.7priority
- CVE-2008-6508Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows…83.7%Top 0.31%29.9priority
- CVE-2019-20372NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the…Public exploit1 report15.0%Top 3.3%29.8priority
- CVE-2021-23017A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from…Public exploit1 report53.5%Top 1%29.7priority
- CVE-2017-7529Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range…nginx · nginxPublic exploitT1190Exploit Public-Facing ApplicationT1005Data from Local System1 report62.6%Top 0.81%28.7priority
- CVE-2017-20005NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a…Critical · 9.81 report3.3%Top 12%28.4priority
- CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingApache Software Foundation · Apache HTTP ServerMedium · 5.3T1190Exploit Public-Facing ApplicationT1557Adversary-in-the-Middle1 report55.9%Top 0.95%28.1priority
- CVE-2000-0208The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name…Public exploit1 report6.9%Top 5.9%27.7priority
- CVE-2006-20001Apache HTTP Server: mod_dav out of bounds read, or write of zero byteApache Software Foundation · Apache HTTP ServerPublic exploit1 report3.6%Top 11%27.4priority
- CVE-2016-1247The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04…Public exploit1 report4.9%Top 8%27.3priority
- CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierApache Software Foundation · Apache HTTP Server1 report28.2%Top 1.9%24.9priority
- CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebodyApache Software Foundation · Apache HTTP ServerT1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation1 report69.1%Top 0.65%24.8priority
- CVE-2015-3668QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote…1 report3.1%Top 12%21.4priority
- CVE-2021-3618ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different…1 report2.0%Top 19%20.1priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Apache Log4J (CVE-2021-44228)
HTSearch (CVE-2000-0208) Jive Openfire (CVE-2008-6508) HTTP Directory Traversal HTTP SQL Injection Exploit Procedures Used by Attackers Initial Foothold Expansion / Pivoting Malware Exfiltration / Post Compromise Initial Payload Threat Actor CVE-2021-44228 52% Apache Log4J (CVE-2021-44228)
CVE-2022-22965 Original (opens in a new tab) ↗
Spring Core RCE (CVE-2022-22965)
CVE-2023-34362 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
To put this into context, in Trustwave SpiderLabs data, the MOVEit RCE (CVE- 2023-34362) vulnerability is one of the top exploits targeting hospitality
(CVE-2023-34362) is one of the top exploits targeting our hospitality clients.
In addition to exploiting a previously undisclosed vulnerability (CVE-2023- 34362) in MOVEit Transfer, group has a history of conducting similar
CVE-2022-44698 Original (opens in a new tab) ↗
blocks and exploit vulnerabilities such as CVE-2022-44698.
CVE-2023-21932 Original (opens in a new tab) ↗
Oracle PMS(Vulnerable to CVE-2023-21932
CVE-2008-6508 Original (opens in a new tab) ↗
Jive Openfire (CVE-2008-6508)
CVE-2019-20372 Original (opens in a new tab) ↗
SQLite DoS vulnerability (CVE-2019-20372)
CVE-2021-23017 Original (opens in a new tab) ↗
Apache Tomcat HTTP Request Smuggling (CVE-2021-23017)
CVE-2017-7529 Original (opens in a new tab) ↗
vulnerabilities: ALPACA Attack(CVE-2021-3618) Apache Tomcat HTTP Request Smuggling (CVE-2021-23017) Mod_dav module of httpd DoS (CVE-2006-20001) Mod_proxy module of httpd (CVE-2022-37436) SQLite DoS vulnerability (CVE-2019-20372) Jenkins RCE (CVE-2017-20005) Nginx web server DoS (CVE-2017-7529)
CVE-2017-20005 Original (opens in a new tab) ↗
Denial of Service or Remote Code Execution vulnerabilities: ALPACA Attack(CVE-2021-3618) Apache Tomcat HTTP Request Smuggling (CVE-2021-23017) Mod_dav module of httpd DoS (CVE-2006-20001) Mod_proxy module of httpd (CVE-2022-37436) SQLite DoS vulnerability (CVE-2019-20372) Jenkins RCE (CVE-2017-20005)
CVE-2022-37436 Original (opens in a new tab) ↗
Mod_proxy module of httpd (CVE-2022-37436)
CVE-2000-0208 Original (opens in a new tab) ↗
HTSearch (CVE-2000-0208)
CVE-2006-20001 Original (opens in a new tab) ↗
Mod_dav module of httpd DoS (CVE-2006-20001)
CVE-2016-1247 Original (opens in a new tab) ↗
Apache Tomcat HTTP Request Smuggling (CVE-2021-23017) Mod_dav module of httpd DoS (CVE-2006-20001) Mod_proxy module of httpd (CVE-2022-37436) SQLite DoS vulnerability (CVE-2019-20372) Jenkins RCE (CVE-2017-20005) Nginx web server DoS (CVE-2017-7529) Spring Framework RCE (CVE-2016-1247)
CVE-2022-22720 Original (opens in a new tab) ↗
DoS (CVE-2006-20001) Mod_proxy module of httpd (CVE-2022-37436) SQLite DoS vulnerability (CVE-2019-20372) Jenkins RCE (CVE-2017-20005) Nginx web server DoS (CVE-2017-7529) Spring Framework RCE (CVE-2016-1247) Apache HTTP Server DoS (CVE-2022-22719) Apache HTTP Request Smuggling (CVE-2022-22720)
CVE-2022-22719 Original (opens in a new tab) ↗
Smuggling (CVE-2021-23017) Mod_dav module of httpd DoS (CVE-2006-20001) Mod_proxy module of httpd (CVE-2022-37436) SQLite DoS vulnerability (CVE-2019-20372) Jenkins RCE (CVE-2017-20005) Nginx web server DoS (CVE-2017-7529) Spring Framework RCE (CVE-2016-1247) Apache HTTP Server DoS (CVE-2022-22719)
CVE-2015-3668 Original (opens in a new tab) ↗
(CVE-2015-3668).
CVE-2021-3618 Original (opens in a new tab) ↗
ALPACA Attack(CVE-2021-3618)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.