US CISA added actively exploited vulnerabilities in SugarCRM and Oracle products to its Known Exploited Vulnerabilities Catalog.

The Cybersecurity and Infrastructure Security Agency (CISA) added Oracle and SugarCRM flaws, respectively tracked as CVE-2022-21587 and CVE-2023-22952, to its Known Exploited Vulnerabilities Catalog.

The CVE-2022-21587 flaw (CVSS score 9.8) affects the Oracle E-Business Suite, which is a set of enterprise applications that allows organizations automate processes such as supply chain management (SCM), enterprise resource planning (ERP), and customer relationship management (CRM).

The vulnerability resides in the Web Applications Desktop Integrator of Oracle’s enterprise product and was addressed in October 2022.

An unauthenticated attacker can easily exploit the flaw via HTTP to take over Oracle Web Applications Desktop Integrator installs. The issue impacts versions 12.2.3-12.2.11.

Shadowserver researchers reported having observed first exploitation attempts on January 21, only five days after the cybersecurity firm Viettel Cyber Security released a PoC exploit code for this issue.

The CVE-2023-22952 flaw (CVSS score 8.8) is a Remote Code Execution vulnerability that affects multiple SugarCRM products.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by February 23, 2023.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Known Exploited Vulnerabilities Catalog)

The post CISA adds Oracle, SugarCRM bugs to its Known Exploited Vulnerabilities Catalog appeared first on Security Affairs.

Ukraine and Russia traded almost 200 prisoners of war in a swap announced separately by both sides on Saturday, with the bodies of two British volunteers also being sent back to Ukraine.

The Ukrainian president’s chief of staff, Andriy Yermak, said 116 Ukrainians had been returned, while Russian news agencies cited Moscow’s defence ministry as saying 63 Russian POWs had been freed.

“We managed to return 116 of our people, defenders of Mariupol, partisans from Kherson, snipers from the Bakhmut (front) and other heroes of ours,” Yermak wrote on Telegram.

President Volodymyr Zelenskiy said in a video address that since the war started last February, Ukraine had secured the release of 1,762 men and women from Russian captivity.

Yermak also said the bodies of British volunteer aid workers Andrew Bagshaw and Chris Parry had been sent back to Ukraine.

Bagshaw and Parry were killed during an attempted humanitarian evacuation in eastern Ukraine in January, Parry’s family has previously said.

Russia’s Defence Ministry said the released Russian servicemen included “sensitive category” persons, whose exchange was made possible through the mediation of the United Arab Emirates (UAE), according to agencies.

Tens of thousands of Israelis braved heavy rain on Saturday for a fifth week of protests against judicial reform plans by Prime Minister Benjamin Netanyahu’s new government that critics say threaten democratic checks on ministers by the courts.

The plans, which the government says are needed to curb overreach by judges, have drawn fierce opposition from groups including lawyers, and raised concerns among business leaders, widening already deep political divisions in Israeli society.

“I’m here tonight protesting against the transition of Israel from a democracy to an autocracy,” Dov Levenglick, 48, a software engineer told Reuters in Tel Aviv.

“It’s a disgrace, it shall not stand.”

Netanyahu has dismissed the protests as a refusal by leftist opponents to accept the results of last November’s election, which produced one of the most right-wing governments in Israel’s history.

The protesters say Israeli democracy would be undermined if the government succeeds in pushing through the plans, which would tighten political control over judicial appointments and limit the Supreme Court’s powers to overturn government decisions or Knesset laws.

“They want to tear up the judiciary system of Israel, they want to tear up Israeli democracy, and we are here every week in every weather … to fight against it and to fight for Israeli democracy,” Hadar Segal, 35, told Reuters in Tel Aviv.

Opposition leader Yair Lapid joined demonstrations in the coastal city of Haifa, where he said protesters “came to save their country, and we came to protest with them.”

Related Galleries:

Source link

The post Dnipropetrovsk region comes under heavy artillery fire twice today appeared first on Ukraine Intelligence.

The US Supreme Court building in Washington, DC.

AP Photo/Alex Brandon

• Several Supreme Court justices used their personal emails for work-related communications, per CNN.
• Some printers didn’t use security logs, while “burn bags” were also left unattended, per the report.
• After the leak of the Roe draft opinion, the court’s security measures have faced intense scrutiny.

Several Supreme Court justices utilized their personal email accounts for work-related communications in lieu of secure servers that were set up to protect such information — well before the Dobbs v. Jackson draft opinion that overturned Roe v. Wade was leaked to the media last year — according to CNN.

Multiple individuals with knowledge of the court’s operations told the network of longstanding internal practices that could have threatened its security, contributed to the leak of the draft opinion, and prevented the court from determining who disclosed the Roe document to the public.

In a stunning revelation, the individuals told CNN that Supreme Court employees utilized printers that didn’t produce logs, while “burn bags” — which were used to hold documents that would eventually be destroyed — were left unattended in hallways.

“This has been going on for years,” a former court employee told the network.

According to the report, the email issue persisted because several justices were slow in shifting to the new technology — and some staffers were anxious about approaching the jurists to take the added security measures, according to one individual who spoke with CNN.

A former court employee told CNN that the justices were “not masters of information security protocol.”

In its final report probing the Dobbs draft leak, the court in a statement called the action a “grave assault” on the court’s legitimacy, with the Marshal of the Court seeking to craft a strategy to avoid such a scenario moving forward.

The added revelations come as the Supreme Court has hit a major crossroads. It has become a body dominated by right-leaning jurists — with a 6-3 conservative tilt — and in recent years has made several rulings that have not only been unpopular among the general public but have contributed to a sharp decline in confidence of the court among Americans.

The justices have by and large sought to defend the integrity of the court, especially in the aftermath of the overturn of Roe v. Wade last June — which ended nearly 50 years of federal abortion rights.

But the leak of the draft decision has raised even more questions about the court’s handling of key internal matters.

The final report last month stated that “it is not possible to determine the identity of any individual who may have disclosed the document or how the draft opinion ended up with Politico.” 

And Supreme Court Marshal Gail Curley in the report remarked that the “court’s current method of destroying court sensitive documents has vulnerabilities that should be addressed.”

However, according to three former employees who spoke with CNN, there were no standard protocols for handling the “burn bags,” which hold sensitive documents that are subsequently destroyed.

Per a source with knowledge of the court’s security measures, employees can utilize the burn bags which are then taken to the Supreme Court building’s basement and then picked up by a shredding company.

While some burn bags were stapled shut, some were just filled to the top and left near desks to be picked up, while others were left unattended in the hallway outside of the chambers, per the CNN report.

The source also told CNN that it would not have been hard for an individual with a clearance to non-public areas of the court to get a hold of sensitive materials.

Ukrainian President Volodymyr Zelenskiy said on Saturday that the situation on the front lines in the east of the country was getting tougher and Russia was throwing more and more troops into battle.

Russian forces are slowly gaining ground in the Donbas region, encircling the city of Bakhmut north of Donetsk and battling to take control of a nearby road which is a major supply route for Ukrainian forces. They are also trying to capture Vuhledar, southwest of Donetsk.

“I’ve often had to say the situation at the front is tough, and is getting tougher, and it’s that time again. … The invader is putting more and more of his forces into breaking down our defences,” Zelenskiy said in a video address.

“It is very difficult now in Bakhmut, Vuhledar, Lyman and other directions,” he continued.

Earlier in the day, Deputy Defence Minister Hanna Malyar wrote on Telegram that Russian efforts to break the defences in Bakhmut and Lyman had failed.

Lyman, which lies just to the north of Bakhmut, was liberated by Ukrainian forces last October.

---

Source link

The post Russians hurl all effort into breaking through defense lines, encircling Bakhmut appeared first on Ukraine Intelligence.