Uncategorized

Microsoft issued a warning about a critical .NET Core remote code execution vulnerability in PowerShell version 7. This is caused by the way text encoding is performed in .NET 5 and .NET Core.

On July 17th 2021, a post was made to the website “Bleeping Computer” regarding a recent ransomware attack on VMWare ESXI version 7 servers. This ransomware group named “Hello Kitty” was responsible for the attack on the video game company “CD Projekt RED”, where they stole the source code for their games and uploaded them to their leak site.

In an advisory released by Solarwinds on July 9th 2021 via their website, they were notified by Microsoft about a critical security vulnerability that affects their Serv-U Managed File Transfer and Serv-U Secure FTP products.
This vulnerability (CVE-2021-35211) allows Remote Code Execution (RCE) in the products mentioned above.

On July 2, 2021 Kaseya released an emergency communication via their website about a compromise of their VSA system being used to spread ransomware to client systems. Dataprise immediately shut down all on-premises Kaseya VSA servers and conducted a thorough investigation which determined that our VSA servers were not compromised.

A serious Remote Code Execution (RCE) vulnerability has been identified in the Print Spooler service in Windows Operating Systems. Successful exploitation of this vulnerability can allow an authenticated attacker to execute code and gain SYSTEM privileges. This vulnerability can be mitigated by stopping and disabling the Print Spooler service in Windows, especially Domain Controllers.