Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request. CVSSv3.1 7.5 (HIGH) · EPSS 98th percentile
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on t CVSSv3.1 8.8 (HIGH) · EPSS 80th percentile
Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery.This issue affects Project Management System: before 4.09.31.125. CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile
The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile
Elastic Security Labs published original research on detecting LRPC-based parent PID spoofing attacks, where adversaries use RPC (DCOM, WMI, MMC20.Application) to spawn child processes and obscure the true parent-child relationship. The research traces the evasion-detection arms race, documents weaknesses in current detection approaches including ETW-based correlation, and reveals that WMI's ClientProcessId telemetry can be spoofed by malicious clients, rendering it unreliable for forensic reconstruction.
Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile
A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVSSv3.1 7.1 (HIGH) · EPSS 97th percentile
Elastic Security Labs analyzed REF2924, an advanced threat group that has shifted from custom malware to open-source tools and publicly available source code for persistence and lateral movement. The group deployed a .NET webshell (Behinder-derived), a custom persistence module (kavUpdate.exe) that creates scheduled domain admin accounts, and leveraged tools like TFirewall, AdFind, Impacket secretsdump, and NTDSDumpEx for credential harvesting and Active Directory reconnaissance. The attack chain demonstrates a sophisticated understanding of Exchange OWA environments, NTDS extraction, and LSASS credential dumping, with strong attribution fingerprints linking the group to public GitHub repositories and security research.
ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of certificates at the application layer (not the transport layer) and "Certificates are exchanged in a controlled fashion between entities within a trust relationship. This is why self-signed certificates may be used and why validating certificates isn’t as important as doing so for the transport layer certificates." CVSSv3.1 9.8 (CRITICAL) · EPSS 49th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in As Koc Energy Web Report System allows SQL Injection. This issue affects Web Report System: before 23.03.10. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
Elastic Security Labs identified SOMNIRECORD, a new C++ backdoor malware attributed to REF2924 that uses DNS-over-TXT record queries to communicate with C2 infrastructure while evading network-based detection. The malware supports five command types (SYS, PSL, ECM, sleep, WS) and was likely derived from the open-source DNS-Persist project, enabling attackers to bypass firewall and IDS controls.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Pacsrapor: before 1.22. CVSSv3.1 9.8 (CRITICAL) · EPSS 65th percentile
Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abuse. This issue affects DigiKent: before 23.03.20. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
Elastic Security Labs published a comprehensive end-to-end analysis of a recent ICEDID malware variant, detailing its multi-stage loader and bot payload execution chain. The research covers ICEDID's capabilities including virtualization detection, anti-analysis techniques, credential theft, C2 communications, browser proxy installation, and reverse shell deployment. Elastic released detection logic, YARA rules, and prevention signatures to help defenders identify and block ICEDID infections.
The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to append additional SQL queries into already existing queries that can be used to extract sensitive information fr CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon." CVSSv3.1 9.8 (CRITICAL)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgra CVSSv3.1 9.1 (CRITICAL) · EPSS 47th percentile
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile
A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saysis Starcities allows SQL Injection. This issue affects Starcities: through 1.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile