Update Details
Update #3426 (10/12/2021)
9 new signatures:
| MEDIUM | HTTP:APACHE:APACHE-PATH-TRAV | HTTP: Apache HTTP Server Directory Traversal |
| MEDIUM | HTTP:ORACLE:IPLANET-INFO-DISC | HTTP: Oracle Iplanet CVE-2020-9315 Information Disclosure |
| HIGH | HTTP:SQL:INJ:ZOHO-ME-OPMANGR | HTTP: Zoho ManageEngine OpManager getReport SQL Injection |
| HIGH | HTTP:SQL:INJ:CNTRN-KB-PRXY-INJ | HTTP: Centreon KnowledgeBase Proxy ProceduresProxy.class.php SQL Injection |
| HIGH | HTTP:APACHE:HTTPD-MOD-BOF | HTTP: Apache HTTPD Mod Mime Buffer OverRead |
| HIGH | HTTP:XSS:WRDPRS-KINGCOMPOSER | HTTP: WordPress KingComposer plugin Cross-Site Scripting |
| HIGH | HTTP:CTS:WP-BBPRS-UNAUTH-EOP | HTTP: WordPress Plugin BBPress Unauthenticated Privilege Escalation |
| HIGH | HTTP:STC:DL:CVE-2021-40467-EOP | HTTP: Windows CLFS kernel driver CVE-2021-40467 Elevation of Privilege |
| HIGH | HTTP:STC:DL:CVE-2021-40466-EOP | HTTP: Windows CLFS kernel driver CVE-2021-40466 Elevation of Privilege |
2 updated signatures:
| HIGH | HTTP:STC:ADOBE:RDR-ACROFORM-UAF | HTTP: Adobe Acrobat and Acrobat Reader DC AcroForm Use After Free |
| HIGH | HTTP:PHP:VBULLETIN-RCE | HTTP: vBulletin Pre-Auth Remote Code Execution |
Details of the signatures included within this bulletin:
HTTP:APACHE:APACHE-PATH-TRAV - HTTP: Apache HTTP Server Directory Traversal
Severity: MEDIUM
Description:
This signature detects attempts to exploit a known vulnerability against Apache HTTP Server. A successful attack can lead to directory traversal and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2021-42013
- url: https://httpd.apache.org/security/vulnerabilities_24.html
- cve: CVE-2021-41773
Affected Products:
- Apache http_server 2.4.49
HTTP:SQL:INJ:ZOHO-ME-OPMANGR - HTTP: Zoho ManageEngine OpManager getReport SQL Injection
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Zoho ManageEngine OpManager. A successful attack can lead to command injection and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2021-41288
Affected Products:
- Zohocorp manageengine_opmanager 12.5
- Zohocorp manageengine_opmanager 12.4
HTTP:ORACLE:IPLANET-INFO-DISC - HTTP: Oracle Iplanet CVE-2020-9315 Information Disclosure
Severity: MEDIUM
Description:
This signature detects attempts to exploit a known vulnerability against Oracle. A successful attack can lead to sensitive information disclosure.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2020-9315
Affected Products:
- Oracle iplanet_web_server 7.0-7.0.27
HTTP:SQL:INJ:CNTRN-KB-PRXY-INJ - HTTP: Centreon KnowledgeBase Proxy ProceduresProxy.class.php SQL Injection
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Centreon. A successful attack can lead to command injection and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
Affected Products:
- Centreon centreon 20.10.0
- Centreon centreon 21.04.0
- Centreon centreon
HTTP:APACHE:HTTPD-MOD-BOF - HTTP: Apache HTTPD Mod Mime Buffer OverRead
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Apache HTTPD. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2017-7679
Affected Products:
- Apache http_server 2.2.0
- Apache http_server 2.4.0
HTTP:XSS:WRDPRS-KINGCOMPOSER - HTTP: WordPress KingComposer plugin Cross-Site Scripting
Severity: HIGH
Description:
This signature detects attempts to exploit a known cross-site scripting vulnerability against WordPress KingComposer plugin. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2020-15299
Affected Products:
- King-theme kingcomposer 2.9.4
HTTP:CTS:WP-BBPRS-UNAUTH-EOP - HTTP: WordPress Plugin BBPress Unauthenticated Privilege Escalation
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against WordPress Plugin BBPress. A successful attack can lead to elevation of privilege and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2020-13693
Affected Products:
- Bbpress bbpress
HTTP:STC:ADOBE:RDR-ACROFORM-UAF - HTTP: Adobe Acrobat and Acrobat Reader DC AcroForm Use After Free
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Adobe Acrobat and Acrobat Reader DC AcroForm. A successful attack can lead to arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1
References:
- cve: CVE-2021-39840
- url: http://www.zerodayinitiative.com/advisories/ZDI-21-1096/
- url: https://www.zerodayinitiative.com/advisories/ZDI-21-1099/
- cve: CVE-2021-39837
- url: https://www.zerodayinitiative.com/advisories/ZDI-21-1101/
- cve: CVE-2021-39839
- url: https://www.zerodayinitiative.com/advisories/ZDI-21-1098/
- cve: CVE-2021-39838
- cve: CVE-2021-39836
HTTP:PHP:VBULLETIN-RCE - HTTP: vBulletin Pre-Auth Remote Code Execution
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against vBulletin. A successful attack can lead to arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2020-17496
- cve: CVE-2019-16759
Affected Products:
- Vbulletin vbulletin 5.0.0-5.5.4
HTTP:STC:DL:CVE-2021-40467-EOP - HTTP: Windows CLFS kernel driver CVE-2021-40467 Elevation of Privilege
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Windows Kernel Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2021-40467
Affected Products:
- Microsoft windows_10 20h2
- Microsoft windows_server_2022
- Microsoft windows_10 1607
- Microsoft windows_server_2008 r2
- Microsoft windows_server_2016 2004
- Microsoft windows_10 2004
- Microsoft windows_rt_8.1
- Microsoft windows_10
- Microsoft windows_server_2012
- Microsoft windows_server_2016 20h2
- Microsoft windows_10 21h1
- Microsoft windows_8.1
- Microsoft windows_server_2019
- Microsoft windows_7
- Microsoft windows_server_2008
- Microsoft windows_10 1909
- Microsoft windows_11
- Microsoft windows_server_2016
- Microsoft windows_10 1809
- Microsoft windows_server_2012 r2
HTTP:STC:DL:CVE-2021-40466-EOP - HTTP: Windows CLFS kernel driver CVE-2021-40466 Elevation of Privilege
Severity: HIGH
Description:
This signature detects attempts to exploit a known vulnerability against Windows Kernel Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.
Supported On:
idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1
References:
- cve: CVE-2021-40466
Affected Products:
- Microsoft windows_10 20h2
- Microsoft windows_server_2022
- Microsoft windows_10 1607
- Microsoft windows_server_2008 r2
- Microsoft windows_server_2016 2004
- Microsoft windows_10 2004
- Microsoft windows_rt_8.1
- Microsoft windows_10
- Microsoft windows_server_2012
- Microsoft windows_server_2016 20h2
- Microsoft windows_10 21h1
- Microsoft windows_8.1
- Microsoft windows_server_2019
- Microsoft windows_7
- Microsoft windows_server_2008
- Microsoft windows_10 1909
- Microsoft windows_11
- Microsoft windows_server_2016
- Microsoft windows_10 1809
- Microsoft windows_server_2012 r2