Bisonal Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (16)

Linguaggio

en	10
zh	4
it	2

Nazione

cn	8
us	6
th	2

Attori

Bisonal	3

Interesse

Genere

Not Defined	8
Server Management Software	2
Network Encryption Software	2
WordPress Plugin	2
SSH Server Software	2

Fornitore

Not Defined	8
VMware	2
furlongm	2
Bitrix	2
Thomas R. Pasawicz	2

Prodotto

VMware vCenter Server	2
furlongm openvpn-monitor	2
CodeIgniter	2
Autoptimize Plugin	2
Bitrix Site Manager	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	Bitrix Site Manager redirect.php escalazione di privilegi	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.03	CVE-2008-2052
2	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.09	CVE-2008-5928
3	Idera Travis CI Activation .travis.yml rivelazione di un 'informazione	2.6	2.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00156	0.02	CVE-2021-41077
4	Autoptimize Plugin Import escalazione di privilegi	5.4	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01016	0.00	CVE-2021-24376
5	Bitrix Upload from Local Disk Feature restore.php escalazione di privilegi	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2022-29268
6	Bitrix Site Manager Vote Module Remote Code Execution	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00668	0.07	CVE-2022-27228
7	SSH Agent Plugin escalazione di privilegi	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2022-20620
8	CodeIgniter Sendmail Email.php escalazione di privilegi	8.5	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04920	0.04	CVE-2016-10131
9	Atlassian Bitbucket Data Center directory traversal	8.1	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00441	0.02	CVE-2019-3397
10	furlongm openvpn-monitor Management Interface Socket escalazione di privilegi	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.00	CVE-2021-31605
11	VMware vCenter Server Analytics Service escalazione di privilegi	8.6	8.5	$5k-$25k	$0-$5k	High	Official Fix	0.97389	0.00	CVE-2021-22005
12	WordPress HTML Element general-template.php cross site scripting	4.4	4.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00094	0.03	CVE-2017-17093
13	Linux Kernel UDP Packet udp.c escalazione di privilegi	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04837	0.03	CVE-2016-10229
14	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash rivelazione di un 'informazione	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
15	Tiki TikiWiki tiki-editpage.php escalazione di privilegi	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01194	0.03	CVE-2004-1386
16	INFINICART browse_group.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00262	0.00	CVE-2006-5957

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Identified	Genere	Fiducia
1	0.0.0.0		Bisonal	07/03/2020	verified	Alto
2	61.90.202.197	61-90-202-197.static.asianet.co.th	Bisonal	07/03/2020	verified	Alto
3	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxxx.xxxxxxx.xx.xx	Xxxxxxx	07/03/2020	verified	Alto
4	XX.XXX.XXX.XX	xxxxxxxx.xxx	Xxxxxxx	07/03/2020	verified	Alto
5	XXX.XXX.XXX.XX		Xxxxxxx	22/12/2020	verified	Alto
6	XXX.XXX.XXX.XXX		Xxxxxxx	07/03/2020	verified	Alto
7	XXX.XXX.XXX.XXX		Xxxxxxx	30/07/2022	verified	Alto
8	XXX.XX.XX.XXX		Xxxxxxx	22/12/2020	verified	Alto

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (16)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	.travis.yml	predictive	Media
2	File	browse_group.asp	predictive	Alto
3	File	data/gbconfiguration.dat	predictive	Alto
4	File	xxxxx.xxx	predictive	Media
5	File	xxxxxxxx.xxx	predictive	Media
6	File	xxxxxxx.xxx	predictive	Media
7	File	xxxx-xxxxxxxx.xxx	predictive	Alto
8	File	xxx.x	predictive	Basso
9	File	xx-xxxxxxxx/xxxxxxx-xxxxxxxx.xxx	predictive	Alto
10	Library	xxxxxx/xxxxxxxxx/xxxxx.xxx	predictive	Alto
11	Argument	xxxxx->xxxx	predictive	Media
12	Argument	xxxx	predictive	Basso
13	Argument	xx	predictive	Basso
14	Argument	xxxx	predictive	Basso
15	Argument	xxxxx	predictive	Basso
16	Network Port	xxx	predictive	Basso

Referenze (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!