{"vulnerability": "cve-2023-2499", "sightings": [{"uuid": "8b226595-d624-49cb-b648-6891228d0420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5963", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-27901\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.\n\ud83d\udccf Published: 2023-03-08T17:14:50.696Z\n\ud83d\udccf Modified: 2025-02-28T18:45:56.466Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030", "creation_timestamp": "2025-02-28T19:27:10.000000Z"}, {"uuid": "b995dbe0-b418-4ba5-8565-01f7f20d3cae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24997", "type": "seen", "source": "https://t.me/ics_cert/740", "content": "\u0647\u0634\u062f\u0627\u0631\n\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0622\u067e\u0627\u0686\u06cc \n\n\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u067e\u0644\u062a\u200c\u0641\u0631\u0645 \u06cc\u06a9\u067e\u0627\u0631\u0686\u0647\u200c\u0633\u0627\u0632\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc Apache InLong \u0628\u0647 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u062f \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0645\u0631\u0628\u0648\u0637 \u0645\u06cc\u200c\u0634\u0648\u062f. \n\n\u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0627 \u0628\u0631 \u0645\u062d\u0631\u0645\u0627\u0646\u06af\u06cc\u060c \u06cc\u06a9\u067e\u0627\u0631\u0686\u06af\u06cc \u0648 \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0628\u0648\u062f\u0646 \u062a\u0623\u062b\u06cc\u0631 \u0628\u06af\u0630\u0627\u0631\u062f.\n\nBDU: 2023-01911\nCVE-2023-24997\n\n\u0628\u0647 \u0631\u0648\u0632 \u0631\u0633\u0627\u0646\u06cc \u0647\u0627 \u0631\u0627 \u0627\u0632 \u0645\u0646\u0627\u0628\u0639 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0646\u0635\u0628 \u06a9\u0646\u06cc\u062f.\n\u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0634\u0631\u0627\u06cc\u0637 \u0641\u0639\u0644\u06cc \u0648 \u062a\u062d\u0631\u06cc\u0645 \u0647\u0627\u06cc \u0627\u0639\u0645\u0627\u0644 \u0634\u062f\u0647\u060c \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc \u0634\u0648\u062f \u0628\u0647 \u0631\u0648\u0632 \u0631\u0633\u0627\u0646\u06cc \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u062a\u0646\u0647\u0627 \u067e\u0633 \u0627\u0632 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u062a\u0645\u0627\u0645 \u062e\u0637\u0631\u0627\u062a \u0645\u0631\u062a\u0628\u0637 \u0646\u0635\u0628 \u06a9\u0646\u06cc\u062f.\n\n\u0627\u0642\u062f\u0627\u0645\u0627\u062a \u062c\u0628\u0631\u0627\u0646\u06cc:\n- \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0641\u0627\u06cc\u0631\u0648\u0627\u0644 \u062f\u0631 \u0633\u0637\u062d \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0648\u0628 \u0628\u0631\u0627\u06cc \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631.\n- \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0634\u0628\u06a9\u0647 \u0647\u0627\u06cc \u062e\u0627\u0631\u062c\u06cc (\u0627\u06cc\u0646\u062a\u0631\u0646\u062a)\u061b\n- \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0634\u0628\u06a9\u0647 \u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0645\u062c\u0627\u0632\u06cc \u0628\u0631\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u062f\u0647\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (VPN).\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0648\u0635\u06cc\u0647 \u0647\u0627\u06cc \u0633\u0627\u0632\u0646\u062f\u0647:\nhttps://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8\n\n\u0644\u0637\u0641\u0627 \u0646\u0638\u0631\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u0628\u0647 \u0627\u0634\u062a\u0631\u0627\u06a9 \u0628\u06af\u0630\u0627\u0631\u06cc\u062f. \u0627\u0632 \u0628\u0627\u0632\u062e\u0648\u0631\u062f \u0634\u0645\u0627 \u0627\u0633\u062a\u0642\u0628\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2023-04-11T17:38:02.000000Z"}, {"uuid": "78d8ee61-db97-4fba-ab87-eeff3af0205a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5964", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-27900\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.\n\ud83d\udccf Published: 2023-03-08T17:14:49.805Z\n\ud83d\udccf Modified: 2025-02-28T18:43:28.521Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030", "creation_timestamp": "2025-02-28T19:27:11.000000Z"}, {"uuid": "1ecf61bc-dd10-4d70-b0cd-cdf96fe8d831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "Telegram/Lw7u-Xk6xSteuBiwyNzWX2LNGzfySroFN8WyCw6GBv2i6to", "content": "", "creation_timestamp": "2023-02-24T21:27:53.000000Z"}, {"uuid": "d762c960-848c-4bca-8228-4e13987181ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "Telegram/HCo7oBc9MuABAZ3fcQP6FO0F8XbROF3_F21Hr1OX3zJVvqUa", "content": "", "creation_timestamp": "2025-03-02T11:45:39.000000Z"}, {"uuid": "0e9c2b16-3b2a-439a-8f35-049ffcd7cf6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "Telegram/9mU-T56rdJAAG8DZW4GTKg2vS2llhDO6biCeQxdJmLS-toX0", "content": "", "creation_timestamp": "2025-03-02T11:45:39.000000Z"}, {"uuid": "c71006b8-89ba-495d-95cd-edbb029314c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-2499", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3008", "content": "Cybersecurity News - Hackers Factory \n\n\n\u200aFlaw in Telegram Gives Attackers Access to macOS Camera\n\nhttps://restoreprivacy.com/flaw-in-telegram-gives-attackers-access-to-macos-camera/\n\n\u200aStealthy MerDoor malware uncovered after five years of attacks\n\nhttps://www.bleepingcomputer.com/news/security/stealthy-merdoor-malware-uncovered-after-five-years-of-attacks/\n\n\u200aTransportation Department breach exposes data of federal employees\n\nhttps://fedscoop.com/transerve-data-breach/\n\n\u200aRansomware gang steals data of 5.8 million PharMerica patients\n\nhttps://www.bleepingcomputer.com/news/security/ransomware-gang-steals-data-of-58-million-pharmerica-patients/\n\n\u200aWhatsApp now lets you lock chats with a password or fingerprint\n\nhttps://www.bleepingcomputer.com/news/security/whatsapp-now-lets-you-lock-chats-with-a-password-or-fingerprint/\n\n\u200aNovel Malware Strain, PIPEDREAM, Deployed by Russian-Linked Hackers Against US Energy Corporations\n\nhttps://latesthackingnews.com/2023/05/15/novel-malware-strain-pipedream-deployed-by-russian-linked-hackers-against-us-energy-corporations/\n\n\u200aVirusTotal AI code analysis expands Windows, Linux script support\n\nhttps://www.bleepingcomputer.com/news/security/virustotal-ai-code-analysis-expands-windows-linux-script-support/\n\n\u200aThe new info-stealing malware operations to watch out for\n\nhttps://www.bleepingcomputer.com/news/security/the-new-info-stealing-malware-operations-to-watch-out-for/\n\n\u200aPhiladelphia Inquirer operations disrupted after cyberattack\n\nhttps://www.bleepingcomputer.com/news/security/philadelphia-inquirer-operations-disrupted-after-cyberattack/\n\n\u200aExploit available for critical RCE (CVE-2023-32314) bug in VM2 sandbox library\n\nhttps://securityonline.info/exploit-available-for-critical-rce-cve-2023-32314-bug-in-vm2-sandbox-library/\n\n\u200aAuthentication Bypass Flaw CVE-2023-2499 in WordPress Plugin With Over 10,000 Installations\n\nhttps://securityonline.info/authentication-bypass-flaw-cve-2023-2499-in-wordpress-plugin-with-over-10000-installations/\n\n\u200aEntropyReducer: Reduce Entropy And Obfuscate Your Payload\n\nhttps://securityonline.info/entropyreducer-reduce-entropy-and-obfuscate-your-payload/\n\n\u200aPoC Released for Linux Kernel Privilege Escalation (CVE-2023-32233) Vulnerability\n\nhttps://securityonline.info/poc-released-for-linux-kernel-privilege-escalation-cve-2023-32233-vulnerability/\n\n\u200aMultiple Vulnerabilities Uncovered in Kiddoware Kids Place Parental Control Android App\n\nhttps://securityonline.info/multiple-vulnerabilities-uncovered-in-kiddoware-kids-place-parental-control-android-app/\n\n\u200aHow the A-GPS in your smartphone works, and whether Qualcomm is tracking you | Kaspersky official blog\n\nhttps://www.kaspersky.com/blog/gps-agps-supl-tracking-protection/48175/\n\n\u200aThe nature of cyberincidents in 2022\n\nhttps://securelist.com/kaspersky-incident-response-report-2022/109680/\n\n\u200aFormer Ubiquiti employee gets 6 years in jail for stealing confidential data and extorting company\n\nhttps://securityaffairs.com/146228/cyber-crime/uiti-employee-sentenced-6-years.html\n\n\u200aIntroducing the DRM-Report Q1 2023: Unveiling the Current State of Ransomware\n\nhttps://securityaffairs.com/146241/malware/drm-dashboard-ransomware-monitor-q1-2023.html\n\n\u200aNew RA Group ransomware gang is the latest group using leaked Babuk source code\n\nhttps://securityaffairs.com/146248/cyber-crime/new-ra-group.html\n\n\u200aMicrosoft Security highlights from RSA Conference 2023\n\nhttps://www.microsoft.com/en-us/security/blog/2023/05/15/microsoft-security-highlights-from-rsa-conference-2023/\n\n\u200aFerrari Website Flaw Exposes Their Database Credentials\n\nhttps://gbhackers.com/ferrari-website-flaw-exposes-their-database-credentials/\n\n\u200aHackers Adapting New Unique Way to Overcome Microsoft Default Macro Block\n\nhttps://gbhackers.com/microsoft-default-macro-block/\n\n\u200aToyota Data Breach \u2013 Over 2 Million Customers Data Exposed\n\nhttps://gbhackers.com/toyota-data-breach/\n\n\u200aWhatsApp \u2013 Now you Can Lock & Hide Chats with a Password\n\nhttps://gbhackers.com/whatsapp-chat-lock/\n\n\nhttps://t.me/dilagrafie", "creation_timestamp": "2023-05-16T11:19:44.000000Z"}, {"uuid": "ce73ab2c-db94-4599-bfa0-1cb15ffa68ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/true_secator/4880", "content": "\u0412 \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u0445 Atlassian \u0438 ISC BIND \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f DoS  \u0438 RCE.\n\n\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u041f\u041e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0432 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 Jira, Confluence, Bitbucket \u0438 Bamboo.\n\n\u0421\u0430\u043c\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0438\u0437 \u044d\u0442\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c CVE-2023-22513\u00a0(CVSS: 8,5) \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u0432 Bitbucket. \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 Bitbucket \u0432\u0435\u0440\u0441\u0438\u0438 8.0.0 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 8.14.0.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2023-22512 (CVSS 7,5) - \u044d\u0442\u043e DoS-\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Confluence Data Center \u0438 Server (\u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.6 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0434\u043e 8.5.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e). \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c, \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0438\u043b\u0438 \u043d\u0430 \u043d\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u043d\u0430\u0440\u0443\u0448\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043b\u0443\u0436\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0445\u043e\u0441\u0442\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043a \u0441\u0435\u0442\u0438.\n\nCVE-2023-28709 (CVSS 7,5), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a DoS-\u043e\u0448\u0438\u0431\u043a\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache Tomcat, \u0432\u043b\u0438\u044f\u044e\u0449\u0430\u044f \u043d\u0430 Bamboo. \u041f\u0440\u0438\u0447\u0435\u043c \u0432 Apache Tomcat \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, CVE-2023-24998, \u0431\u044b\u043b\u043e \u043d\u0435\u043f\u043e\u043b\u043d\u044b\u043c.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Jira, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u00a0CVE-2022-25647\u00a0(CVSS 7,5), \u043e\u0448\u0438\u0431\u043a\u0443 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 Google Gson, \u0432\u043b\u0438\u044f\u044e\u0449\u0443\u044e \u043d\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 Jira Service Management.\n\n\u0414\u0432\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044b ISC \u0432 Berkeley Internet Name Domain 9 (BIND).\n\nCVE-2023-3341\u00a0(CVSS: 7,5) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0441\u0442\u0435\u043a\u0430 \u0432 \u043a\u043e\u0434\u0435 \u043a\u0430\u043d\u0430\u043b\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043c\u0435\u0442\u043e\u0434\u0430 Name (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 9.16.44, 9.18.19, 9.19.17, 9.16.44-S1 \u0438 9.18, 19-S1).\n\n\u0414\u0440\u0443\u0433\u0430\u044f CVE-2023-4236\u00a0(CVSS: 7,5) - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u043a\u043e\u0434\u0435, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u044b DNS-over-TLS, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e named. \u042d\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442, \u043a\u043e\u0433\u0434\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 9.18.19 \u0438 9.18.19-S1).\n\n\u0414\u0430\u043d\u043d\u044b\u0445 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f.", "creation_timestamp": "2023-09-22T14:38:21.000000Z"}, {"uuid": "620bb7a3-2d3a-4e01-babd-a91a75c6ac3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/breachdetector/207052", "content": "{\n  \"Source\": \"documentors\",\n  \"Content\": \"\ud83d\udd25\ud83d\udd25\ud83d\udd25Fresh vulns in Apache(Kerby, Tomcat, Sling, Airflow Google Provider, Airflow Hive Provider & Airflow AWS Provider). \ud83d\udcbeLDAP Injection Vulnerability in Apache Kerby(CVE-2023-25613) \ud83d\udcbeApache Commons FileUpload: FileUpload DoS with excessive parts(CVE-2023-24998) \ud83d\udcbeApache Tomcat - FileUpload DoS with excessive parts(CVE-2023-24998) \ud83d\udcbeApache Sling does not allow to handle i18n content in a secure way(CVE-2023-25621) \ud83d\udcbeApache Airflow Google Provider: Google Cloud Sql Provider RCE \ud83d\udcbeApache Airflow Google Provider: Google Cloud Sql Provider DoS(CVE-2023-25692) \ud83d\udcbeSqoop Apache Airflow Provider RCE Vulnerability(CVE-2023-25693) \ud83d\udcbeApache Airflow Hive Provider Beeline RCE(CVE-2023-25696) \ud83d\udcbeApache Airflow AWS Provider: Arbitrary file read via AWS provider(CVE-2023-25956) Contact \ud83d\udece @darkamo documentors\", \n  \"author\": \"\u2693\ufe0f\ud835\udd07\ud835\udd2c\ud835\udd20\ud835\udd32\ud835\udd2a\ud835\udd22\ud835\udd2b\ud835\udd31\ud835\udd2c\ud835\udd2f\",\n  \"Detection Date\": \"24 Feb 2023\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 t.me/breachdetector \ud83d\udd39", "creation_timestamp": "2023-02-24T15:04:36.000000Z"}, {"uuid": "8ca884f2-fc9f-4966-9178-98967fe2d7b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/ctinow/182499", "content": "https://ift.tt/BrtHjfK\nCVE-2023-24998 | Oracle Retail Customer Management and Segmentation Foundation Internal Operations denial of service", "creation_timestamp": "2024-02-10T09:41:18.000000Z"}, {"uuid": "95988645-a955-4a10-99ae-a5a1ad2361df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/cibsecurity/59851", "content": "\u203c CVE-2023-27901 \u203c\n\nJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-11T00:27:28.000000Z"}, {"uuid": "42da9cb8-c8f0-4d2f-a5d5-f4fc1682a0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/ctinow/181434", "content": "https://ift.tt/9wC6hkB\nCVE-2023-24998 | Oracle Financial Services Revenue Management and Billing 5.0.0/5.1.0 Pricing Services denial of service", "creation_timestamp": "2024-02-08T15:41:59.000000Z"}, {"uuid": "3556ed1f-0f00-4e7a-b355-a772680fd959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/ctinow/181421", "content": "https://ift.tt/nlTCLXO\nCVE-2023-24998 | Oracle Financial Services Compliance Studio 8.1.2.5 Reports denial of service", "creation_timestamp": "2024-02-08T15:11:40.000000Z"}, {"uuid": "22bdef4f-42a2-4654-b466-2cd9f0469287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/cibsecurity/64516", "content": "\u203c CVE-2023-28709 \u203c\n\nThe fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount\u00c2\u00a0could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters\u00c2\u00a0in the query string, the limit for uploaded request parts could be\u00c2\u00a0bypassed with the potential for a denial of service to occur.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-22T14:25:26.000000Z"}, {"uuid": "e73dd4c5-589c-495a-a962-51c44b3b3769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24999", "type": "seen", "source": "https://t.me/cibsecurity/59866", "content": "\u203c CVE-2023-24999 \u203c\n\nHashiCorp Vault and Vault Enterprise\u00e2\u20ac\u2122s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-11T02:56:24.000000Z"}, {"uuid": "37bbffd2-bfaa-477e-ab5b-44781b2685af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24997", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/57313", "content": "\u203c CVE-2023-24997 \u203c\n\nDeserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-01T18:14:07.000000Z"}, {"uuid": "1974345f-dce7-4de6-b162-d5a756c7c242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24998", "type": "seen", "source": "https://t.me/cibsecurity/58524", "content": "\u203c CVE-2023-24998 \u203c\n\nApache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-20T18:15:54.000000Z"}, {"uuid": "c9b332b2-c3d3-4fb3-a303-77bf01f7b7a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24991", "type": "seen", "source": "https://t.me/cibsecurity/58093", "content": "\u203c CVE-2023-24991 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19813)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:36.000000Z"}, {"uuid": "b2d1f7ac-b1f6-4d41-bb05-cfeb8dafa19c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24993", "type": "seen", "source": "https://t.me/cibsecurity/58096", "content": "\u203c CVE-2023-24993 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19815)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:51:36.000000Z"}, {"uuid": "bc424dac-bb0c-4382-bf54-b0704da1b947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24996", "type": "seen", "source": "https://t.me/cibsecurity/58094", "content": "\u203c CVE-2023-24996 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19818)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:37.000000Z"}, {"uuid": "6c8c6eea-580e-41be-ad23-86c6c3705e47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24995", "type": "seen", "source": "https://t.me/cibsecurity/58092", "content": "\u203c CVE-2023-24995 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19817)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:35.000000Z"}, {"uuid": "c78b4635-d9f7-49f6-8a87-12d089beac82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24994", "type": "seen", "source": "https://t.me/cibsecurity/58091", "content": "\u203c CVE-2023-24994 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19816)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:34.000000Z"}, {"uuid": "00dd743b-985f-4a79-ae44-f9e9af0952ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24990", "type": "seen", "source": "https://t.me/cibsecurity/58090", "content": "\u203c CVE-2023-24990 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19812)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:33.000000Z"}, {"uuid": "37cf0ada-eddb-44ed-a131-842e064ea1a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24992", "type": "seen", "source": "https://t.me/cibsecurity/58089", "content": "\u203c CVE-2023-24992 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19814)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-14T14:48:32.000000Z"}]}