Juniper Signature Updates

Signature Update #3455

Tue, 11 Jan 2022 13:15:32 GMT

5 new signatures:

HIGH	HTTP:STC:DL:CVE-2022-21919-EOP	HTTP: Windows User Profile Service CVE-2022-21919 Elevation of Privilege
HIGH	HTTP:CTS:SONICWAL-XML-RPC-RCE	HTTP: SonicWall XML-RPC Remote Code Execution
HIGH	HTTP:CTS:MS-PROT-STACK-RCE	HTTP: Microsoft Windows HTTP Protocol Stack CVE-2022-21907 Remote Code Execution
HIGH	HTTP:STC:DL:MS-WIN-INS-EOP	HTTP: Microsoft Windows Installer CVE-2022-21908 Elevation of Privilege
HIGH	HTTP:CTS:ZOHO-MGNE-NCM-CMDINJ	HTTP: Zoho ManageEngine Network Configuration Manager ping Command Injection

1 deleted protocol anomaly:

MEDIUM

IKE:MALFORMED:INV-PAYLOAD-TYPE

IKE: Invalid Payload Type

1 updated signature.

Thu, 06 Jan 2022 13:15:31 GMT

8 new signatures:

HIGH	HTTP:XSS:SMARTSTORE-NET-INPUT	HTTP: Smartstore SmartStoreNET Stored Cross-Site Scripting
HIGH	HTTP:CTS:HORDE-GRPWRE-CODE-INJ	HTTP: Horde Groupware Webmail Data Import PHP Code Injection
HIGH	HTTP:PHP:ATUTOR-RCE	HTTP: ATutor Remote Code Execution
HIGH	APP:MISC:MANAGE-ENGINE-RCE	APP: Manage Engine Exchange Reporter Plus Unauthenticated RCE
HIGH	HTTP:CTS:DASAN-GPON-CMD-INJ	HTTP: Dasan Gpon Router Command Injection
CRITICAL	HTTP:CTS:TP-LINK-OS-CMD-INJ	HTTP: TP-Link NC2XX OS Command Injection
MEDIUM	HTTP:XSS:DELTA-IADH-XSS	HTTP: Delta Industrial Automation DIAEnergie HandlerAlarmGroup.aspx Stored Cross-Site Scripting
MEDIUM	SMB:MS-AD-NTLM-RELAY-ATTACK	SMB: Microsoft Windows Active Directory NTLM Relay Attack Attempt

4 updated signatures.

Tue, 04 Jan 2022 13:15:33 GMT

6 new signatures:

MEDIUM	HTTP:CTS:ZOHO-ADMGR-FILEUPLD	HTTP: Zoho ManageEngine ADManager Plus PasswordExpiryAction Unrestricted File Upload
LOW	HTTP:STC:SCHNEDR-CBUS-AUTH-BYPS	HTTP: Schneider Electric C-Bus Toolkit Authentication Bypass
HIGH	HTTP:CTS:AJENTI-AUTH-CMD-INJ	HTTP: Ajenti Auth Username Command Injection
HIGH	HTTP:CTS:NSCP-AUTH-RCE	HTTP: NSCP Authenticated Remote Code Execution
HIGH	HTTP:PHP:WP-DATABASE-BACKUP-RCE	HTTP: Wordpress WP-Database-Backup Remote Code Execution
HIGH	APP:MISC:WEBADMIN-UPLOAD-RCE	APP: Webmin Upload Authenticated RCE

1 updated signature.

Thu, 30 Dec 2021 13:15:31 GMT

3 new signatures:

HIGH	TCP:C2S:APACHE-STORM-CMD-INJ	TCP: Apache Storm getTopologyHistory Command Injection
HIGH	HTTP:APACHE:LOG4J-JDBC-APNDR-CE	HTTP: Apache Log4j JDBC Appender DataSource Arbitrary Code Execution
HIGH	HTTP:CTS:COMMVAULT-AUTH-BYPASS	HTTP: Commvault CommCell CVSearchService downLoadFile Authentication Bypass

Tue, 28 Dec 2021 13:15:32 GMT

4 new signatures:

MEDIUM	HTTP:DOS:SQUID-PRXY-HDR-HANDL	HTTP: Squid Proxy HTTP Range Header Handling Denial of Service
HIGH	HTTP:APACHE:SHNYU-JWT-AUTH-BYPS	HTTP: Apache ShenYu Admin JWT Authentication Bypass
HIGH	HTTP:DIR:SCHNDR-STU-STA-MUL-TRV	HTTP: Schneider Electric Multiple Products STU STA Directory Traversal
MEDIUM	HTTP:DIR:GRAFANA-PLUGIN-DIR-TRV	HTTP: Grafana Labs Grafana Plugin Directory Traversal

3 updated signatures.

Thu, 23 Dec 2021 13:15:38 GMT

2 updated signatures.

Tue, 21 Dec 2021 13:15:32 GMT

2 new signatures:

MEDIUM	HTTP:XSS:MS-EXCHG-HNDLBCK	HTTP: Microsoft Exchange Server HandleBackEndCalculationException Reflected Cross-Site Scripting
MEDIUM	HTTP:DOS:APACHE-LOG4J-DOS	HTTP: Apache Log4j2 CVE-2021-45105 Denial Of Service

2 updated signatures.

Thu, 16 Dec 2021 07:01:52 GMT

There were no updates in this release.

Tue, 14 Dec 2021 13:15:32 GMT

2 new signatures:

HIGH	HTTP:STC:DL:CVE-2021-43883-EOP	HTTP: Windows Installer CVE-2021-43883 Elevation of Privilege
HIGH	HTTP:CTS:ZOHO-MGN-ENG-AUTHBYPAS	HTTP: Zoho ManageEngine ServiceDesk Plus Authentication Bypass

1 updated signature.

Mon, 13 Dec 2021 14:12:03 GMT

3 new signatures:

CRITICAL	APP:MISC:APACHE-LOG4J-TCPVR-RCE	APP: Apache Log4j CVE-2021-44228 TCP Variant JNDI Injection
CRITICAL	APP:MISC:APACHE-LOG4J-UDPVR-RCE	APP: Apache Log4j CVE-2021-44228 UDP Variant JNDI Injection
CRITICAL	DNS:APACHE-LOG4J-JNDI-RCE	DNS: Apache Log4j CVE-2021-44228 Remote Code Execution