NoiseLetter April 2024

From Palo Alto PAN OS to D-Link NAS RCE, April has been a whirlwind of activity. Our remarkable labs team released a record-breaking 83 new tags this month, marking a significant milestone for us. Learn more about that and everything else we've been up to in this month's NoiseLetter. Thank you as always for being part of the GreyNoise Community.

‍

Andrew Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like.

‍

‍

Featured

Edge Intel Preview

On May 1st, we will activate a preview of our Edge Intelligence sensors for all existing customers. Sift, our new AI technology for Threat Hunting, is now integrated with sensors and is available upon request to evaluate, along with our Sensor Activity Feed API that provides a feed of Edge activity to integrate with your tools. For further inquiries or assistance, contact product@greynoise.io.

‍

Where to find us

• RSA (In-Person | San Francisco, CA | May 6-9) While GreyNoise will not be a sponsor at this years event we will be around and would love to meet up in the bay area.‍
• FS-ISAC EMEA Summit (In-Person| Berlin, Germany | May 21-23 ) We are very excited to be participating in this years EMEA Summit. If you want to meet up with the team for a demo or a beer hit up abigail@greynoise.io.

‍

Fresh Content

• Livestream Replay: NetNoiseCon
• Report: Honeypots Are Back
• Webinar: Future of Honeypots
• Blog: CVE-2024-3400: Command Injection Vulnerability in PAN-OS‍
• Blog: GreyNoise Tags Its Way to 1337 Elite Status‍
• Blog: CVE-2024-3273: D-Link NAS RCE Exploited in the Wild‍
• Blog: Leveraging AI Advances to Improve Intelligence for Discovery, Identification, and Interpretation
• Blog: What We're Reading: April 2024

‍

Recent Tags and Vulnerabilities

‍

GreyNoise Labs released 83 tags during the month of April:

• ACME Challenge XSS Check
• Adobe ColdFusion Arbitrary File Read CVE-2024-20767 Attempt
• Anheng Honeypot Privilege Escalation Attempt
• Apache Flink 1.9.x RCE Attempt
• Apache Hadoop YARN ResourceManager RCE Attempt
• Apache Tika CVE-2018-1335 Command Injection RCE Attempt
• AspCMS commentlist.asp SQL Injection Attempt
• Bludit 3.13.1 CVE-2021-35323 XSS Attempt
• Bludit 3.13.1 CVE-2021-35323 XSS Check
• CHIYU Converter CVE-2021-31250 XSS Attempt
• CHIYU SEMAC CVE-2021-31643 XSS Attempt
• Citrix StoreFront XSS CVE-2023-5914 Attempt
• ColumbiaSoft DocumentLocator SSRF CVE-2023-5830 Attempt
• CrushFTP Scanner
• D-Link NAS CVE-2024-3273 RCE Attempt
• DbGate Web Client RCE Attempt
• Dell iDRAC Legacy Password Login Attempt
• Dogtag PKI CVE-2022-2414 XXE Attempt
• dotCMS CVE-2020-6754 Path Traversal Attempt
• Drupal CVE-2019-6340 RCE Attempt
• Drupal SQL Injection CVE-2014-3704 Attempt
• Duplicator Unauthenticated Data Exposure CVE-2023-6114 Attempt
• E-cology bsh.servlet.BshServlet RCE Attempt
• EC2 IAM Credential Access Attempt
• ECShop delete_cart_goods.php SQL Injection Attempt
• elFinder 2.1.58 RCE CVE-2021-32682 Attempt
• elFinder 2.1.58 RCE CVE-2021-32682 Check
• ESAFENET CDG Arbitrary File Download CVE-2019-9632 Attempt
• Hiboss Command Injection RCE Attempt
• Inspur ClusterEngine CVE-2020-21224 RCE Attempt
• Joomla PHP Object Injection RCE Attempt
• Joomla! 3.7 SQL Injection CVE-2017-8917 Attempt
• Joomla! Component RWCards 3.0.11 LFI CVE-2008-6172 Attempt
• Joomla! CVE-2008-6080 Directory Traversal Attempt
• Joomla! ProDesk 1.0/1.2 LFI CVE-2008-6222 Attempt
• LearnPress SQL Injection CVE-2023-6567 Attempt
• Looks Like Cloudflare SSL/TLS Recommender
• Looks Like DFind Scanner
• MCMS CVE-2022-23898 SQL Injection Attempt
• Microsoft .NET Framework Information Disclosure Attempt
• Microsoft IIS MDAC msadc CVE-1999-1011 Check
• Multiple Security Gateway Command Injection RCE Attempt
• NETObserve Authentication Bypass RCE Attempt
• Netware Web Server CVE-2001-1580 Source Page Disclosure Attempt
• Nexus Repository Manager CVE-2020-10199 RCE Attempt
• NotificationX SQL Injection CVE-2024-1698 Attempt
• Office Web Apps Server SSRF Attempt
• OpenSIS CVE-2021-40353 SQL Injection Attempt
• PACSOne Server LFI Attempt
• Palo Alto PAN-OS CVE-2024-3400 RCE Attempt
• Presta Custom Product Designer Directory Traversal Attempt
• PrestaShop AtributeWizardPro CVE-2018-10942 Arbitrary File Upload Attempt
• Progress Flowmon CVE-2024-2389 Command Injection RCE Attempt
• Progress Kemp LoadMaster RCE CVE-2024-1212 Attempt
• Qi An Xin Wang Kang Firewall RCE Attempt
• Rebuilt CVE-2024-1021 SSRF Check
• Responsive Filemanager SSRF Attempt
• Samsung WLAN AP RCE Attempt
• ServCity
• SonicWall NetExtender Scanner
• Symantec Endpoint Protection Manager CVE-2013-5014 XXE Attempt
• TBK DVR CVE-2024-3721 Command Injection RCE Attempt
• Telesquare TLR-2005KSH CVE-2024-29269 RCE Attempt
• ThinkAdmin Arbitrary File Read Attempt
• ThinkCMF PHP Code Injection RCE Attempt
• ThinkPHP LFI RCE Attempt
• ThinkPHP PHP Code Injection RCE Attempt
• Tongda OA Login Bypass Attempt
• Ubiquiti Default Credentials Scanner
• vBulletin AjaxReg Blind SQLi Attempt
• vBulletin CVE-2015-7808 PHP Deserialization Attempt
• Weaver E-Cology E-mobile WorkflowCenterTreeData SQL Injection Attempt
• WordPress Automatic Plugin CVE-2024-27954 Attempt
• WordPress Extensive VC WPBakery CVE-2023-0159 RCE Attempt
• WordPress LayerSlider CVE-2024-2879 SQL Injection Attempt
• Wordpress Popup-Maker CVE-2019-17574 Auth Bypass Attempt
• WordPress SupportCandy SQL Injection CVE-2023-1730 Attempt
• XXL-JOB RCE Attempt
• Yonyou NC Arbitrary File Upload Attempt
• Yonyou UFIDA GRP-u8 XXE Attempt
• Zabbix Default Credential Attempt
• ZTE MF971R CVE-2021-21745 Referer Mitigation Bypass Check
• ZZZCMD zzzphp CVE-2019-9041 RCE Attempt

‍

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

‍

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.

‍

‍

‍