InfoSecBulletin Cybersecurity for mankind
IBM QRadar is a popular SIEM (Security Incident and Event Management) tool that organizations use to detect and monitor threats. It can be used in the form of a physical appliance, a software-only solution, or a virtual appliance. As of 2023, over 1,130 companies worldwide use IBM QRadar as part of their SIEM.
Recently, IBM discovered three new vulnerabilities in IBM QRadar. These vulnerabilities were related to cryptography, cross-site scripting (XSS), and information disclosure. IBM has released fixes for these vulnerabilities. The vulnerabilities were discovered by IBM’s Security Ethical Hacking team.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
IBM QRadar SIEM Flaw
CVE-2023-26276: Weak Cryptographic Algorithm:
This vulnerability exists due to the use of a weaker or expected cryptographic algorithm in the QRadar tool, which could allow a threat actor to decrypt highly sensitive information. This vulnerability was given a CVSS Score of 5.9 (medium)
ALSO READ:
Cisco AsyncOS Software Flaw Let Remote Hackers Launch XSS Attack
CVE-2023-26274: Cross-Site Scripting (XSS):
An attacker can exploit this vulnerability to embed arbitrary JS code in the Web UI that can alter the functionality that can lead to credentials disclosure through XSS on a trusted session. This vulnerability was given a CVSS Score of 4.6 (medium).
CVE-2022-34352: Information Disclosure
This vulnerability allows a delegated Admin tenant with a specific domain security profile to see other domain data.This vulnerability was given a CVSS Score of 6.5 (medium).
IBM recommended all its users patch their IBM QRadar SIEM by upgrading it to the latest version.
Source: IBM, GB hacker, vulners.com
