Read Time:18 Second

Posted by malvuln on Mar 20

Discovery / credits: Malvuln – malvuln.com (c) 2022
Original source:
https://malvuln.com/advisory/cc3670f1b3e60e00b43c86d787563a44.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: BuilderOrcus (Orcus.Administration-cracked.exe)
Vulnerability: Insecure Permissions
Description: When building backdoor servers, the malware writes PE files
with insecure permissions to c drive granting change (C) permissions to the
authenticated…

Advisories

[CVE-2021-42063] SAP Knowledge Warehouse <= 7.50 "SAPIrExtHelp" Reflected XSS

March 21, 2022

Read Time:24 Second

Posted by Julien Ahrens (RCE Security) on Mar 20

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: SAP Knowledge Warehouse
Vendor URL:
https://help.sap.com/viewer/816f1f952d244bbf9dd5063e2a0e66b0/7.5.21/en-US/4dc9605e4a9d6522e10000000a15822b.html
Type: Cross-Site Scripting [CWE-79]
Date found: 2021-09-21
Date published: 2022-03-17
CVSSv3 Score: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE:…

Advisories

CVE-2021-45491: Exportable Cleartext Passwords in the 3CX Phone System

March 21, 2022

Read Time:15 Second

Posted by Emanuel DUSS on Mar 20

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: 3CX Phone System
# Vendor: 3CX
# CSNC ID: CSNC-2021-022
# CVE ID: CVE-2021-45491
# Subject: Exportable Cleartext Passwords
# CWE-ID: CWE-257 (Storing Passwords in a Recoverable Format)
# Severity: Medium
# Effect:…

Advisories

CVE-2021-45490: Missing Certificate Verification in 3CX Client for Windows (legacy), Android & iOS

March 21, 2022

Read Time:15 Second

Posted by Emanuel DUSS on Mar 20

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: 3CX Client for Windows (legacy), Android & iOS
# Vendor: 3CX
# CSNC ID: CSNC-2021-021
# CVE ID: CVE-2021-45490
# Subject: Missing Certificate Verification
# CWE-ID: CWE-295 (Improper Certificate Validation)
#…