Threat Intelligence Report - November 18-24 2019

Trends

• The top attacker country was China with 2323 unique attackers (35%).
• The top Exploit event was Authentication with 39% of occurrences.
• The top Trojan C&C server detected was TrickBot with 30 instances detected.

Top Attacker by Country

Threat Geolocation

Top Attacking Hosts

Top Network Attackers

Top Events NIDS and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

CVEs For Which Public Exploits Have Been Detected

ID:        CVE-2019-17671
Title:    WordPress Core Stored Cross-Site Scripting (XSS) vulnerability
Vendor:    Wordpress
Description: A stored Cross-Site Scripting vulnerability within the WordPress Customizer that allows authenticated users to make changes to the WordPress theme to directly customize the interface. This vulnerability could allow unauthenticated users to view private or draft posts, which otherwise would not be viewable.
CVSS v2 Base Score:    5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

ID:        CVE-2019-10098
Title:    Apache Httpd mod_rewrite Open Redirects Vulnerability
Vendor:    Multi-Vendor
Description: In Apache HTTP server, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
CVSS v2 Base Score:    5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

ID:        CVE-2019-10092
Title:    Apache Httpd mod_proxy - Error Page Cross-Site Scripting Vulnerability
Vendor:    Multi-Vendor
Description: In Apache HTTP Server, a limited cross site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
CVSS v2 Base Score:     4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

ID:        CVE-2019-1821
Title:    Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution
Vendor:    Cisco    
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root level privileges on the underlying operating system.
CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-1322
Title:    Microsoft Windows 'COMahawk' Local Privilege Escalation Vulnerability
Vendor:    Microsoft
Description: An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.
CVSS v2 Base Score:    4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-11932
Title:    nipper-ng Remote Stack Buffer Overflow Vulnerability
Vendor:    nipper-ng project
Description: A stack based buffer overflow in the processPrivilage() function in IOS/process-general.c in allows remote attackers (serving firewall configuration files) to achieve Remote Code Execution or Denial Of Service via a crafted file.
CVSS v2 Base Score:    6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)