Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196PUBLISHED: 2023-05-26Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879PUBLISHED: 2023-05-26GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file
User Rank: Ninja
6/20/2019 | 5:53:13 PM
-> Blocking overseas addresses at the ISP layer
-> Create a security dashboard where threat intelligence is shared amoung energy companies, this prescriptive procedure allows organizations who are on the grid to keep ahead of the game especially when actors attack a specific site and they can view the remedy on how to thwart the attack
-> Utilize IPv6 as a way to communicate over the web using IPSec AES256 ESP/AH tunnels
-> Work with IBM and Deep Learning to identify the vulnerabilities in real-time (machine learning at the highest level)
-> Take the best of all Hardened linux machines and create a parallel processing OS that uses docker containers for application level processing where changes are made within a specific time period
-> Simultaneous authorization - Keys are unclocked by two people (similar to nuclear authorization)
-> Distributed NMS network is used to monitor traffic and external communication, anything not on the grid, it gets blocked
-> IP address range limited to devices that are allowed on the network (IPv6 only), only external power companies are able to communicate with the grid and their location is verified by GPS tracking system, if the object moves (routers/switches/firewalls, then someone is notified).
-> Cloud is used as a backup and/or DR resource if the onsite system is compromised, the command and control of the ICS environment can be moved to the cloud (direct connect to multiple CSP - Cloud Service Providers).
-> System recovery should be done in minutes instead of hours
By the way, Schneider Electric was the company who reported on it, AIM Triton overflow was affected
A Windows resolution to address it would be to run the following (complete analysis - https://bit.ly/2XeECIS)
Block Triton ICS Port 39929
-------------------------------
Triton-ICS-Attack-Port-UDP-39929 exists - ok
Linux Perspective:
iptables -I INPUT 1 -p UDP -m multiport -d 192.168.0.0/16 -s 0.0.0.0/0 --dport 39929 --sport 1502 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP
or
ufw deny in proto udp from 0.0.0.0/0 port 1502 to 192.168.0.0/16 port 39929 comment "Triton Attack UDP 1502 and 39929" (this is an ex., the default network could on the 172.16 or 10. Network)
Todd