Orangetw

**Name of the Vulnerable Software and Affected Versions** ModSecurity versions 2.9.11 and below **Description** ModSecurity is a web application firewall engine for Apache, IIS, and Nginx. An attacker can override the HTTP response’s Content-Type, potentially leading to issues such as cross-site scripting (XSS) and arbitrary script source code disclosure. **Recommendations** Update to version 2.9.12 or later.

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.1 through 8.1.28 PHP versions 8.2 through 8.2.19 PHP versions 8.3 through 8.3.7 **Description** An argument injection issue exists in the PHP CGI module on Windows when used with Apache. The flaw occurs because the Windows implementation does not account for "Best-Fit" behavior, where certain Unicode characters are converted to the closest matching ANSI characters during conversion to Win32 API functions. Attackers can send specially crafted HTTP requests containing specific character sequences (such as the soft hyphen `0xAD`) that are misinterpreted as PHP options. This allows a remote attacker to pass arbitrary options to the PHP binary, potentially revealing script source code or achieving remote code execution (RCE). Real-world exploitation has been observed globally, including in the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, Malaysia, and Japan. Attackers have used this flaw to deploy the Msupedge backdoor, Quasar RAT, and XMRig cryptocurrency miners. In some campaigns, tools like JuicyPotato and Cobalt Strike TaoWu plugins were used for privilege escalation and persistence. One reported campaign targeting developers resulted in 241,764 compromised accounts. **Recommendations** Update PHP to version 8.1.29. Update PHP to version 8.2.20. Update PHP to version 8.3.8. As a temporary mitigation, avoid running PHP in CGI mode on Windows servers.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** An issue exists in Microsoft Exchange Server related to code generation management errors. This flaw allows a remote attacker to execute arbitrary code and impact the system. In real-world incidents, this was part of a campaign targeting the Omani government, where attackers used ProxyShell exploits to compromise mail servers and gain persistent access via custom web shells to exfiltrate sensitive data from multiple ministries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** An elevation of privilege issue exists in Microsoft Exchange Server. This flaw allows an attacker to increase their privilege level on the system. Additionally, improper authentication in PowerShell may lead to remote code execution, which allows an attacker to execute arbitrary commands on the server from a remote location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud OS 5 versions prior to 5.07.118 **Description** An issue was discovered that could allow an unauthenticated user to gain access to the device due to a NAS Admin authentication bypass. This could potentially lead to unauthorized access. **Recommendations** For versions prior to 5.07.118, update to version 5.07.118 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sinatra versions 2.0.0 through 2.0.1 **Description** An issue was discovered in the rack-protection/lib/rack/protection/path traversal.rb file. Path traversal is possible via backslash characters. **Recommendations** For Sinatra versions 2.0.0 through 2.0.1, update to version 2.0.1 or later to resolve the issue.