Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection. This issue affects Weighbridge Automation Software: before 1.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection. This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462. CVSSv3.1 8.8 (HIGH) · EPSS 81th percentile
Elastic Security Labs published a comprehensive analysis of vulnerable driver exploitation attacks, demonstrating how ransomware and advanced actors abuse legitimate but flawed kernel drivers to bypass endpoint security. The post details attack primitives (handle duplication, memory access), presents 65 YARA rules for detection, and recommends a defense-in-depth strategy combining blocklisting, allowlisting, behavior controls, and anomaly detection via Elastic Endpoint 8.3+.
Elastic Security Labs published a beaconing detection framework that uses statistical analysis (coefficient of variation, relative variance, autocorrelation) to identify C2 beacon traffic at scale within Elasticsearch. The framework detects both high-frequency and low-frequency beacons with jitter, and was validated against NOBELIUM, Emotet, and Koadic malware samples, reducing search space by orders of magnitude across network logs.
Elastic Security Labs published a comprehensive guide on detecting lateral movement techniques using Event Query Language (EQL) correlation. The post covers detection methodologies for file transfers via SMB, scheduled task abuse, remote registry modification, RDP-based attacks (SharpRDP), and provides concrete EQL queries for both source and target host detection across multiple attack vectors.
Elastic Security Labs documents detection and hunting capabilities for credential access techniques in Elastic Endpoint Security 7.15+, covering file and registry monitoring for sensitive credential stores (SAM, LSA, DPAPI, browser credentials, cloud keys). The post provides KQL/EQL query examples, behavior protection rules, and a comprehensive list of monitored file and registry paths used by credential theft tools like Mimikatz, Lazagne, and various infostealers.
Elastic Security Labs published a comprehensive threat hunting guide focused on detecting malicious DLL loading via Windows execution proxies (rundll32, regsvr32, msiexec), virtual disk images (ISO/VHD), Office documents, archives, and sideloading techniques. The post provides 15+ EQL detection queries with real-world malware examples and 25+ behavioral protection rules to identify both known and unknown DLL-based delivery chains.
The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 98th percentile
Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908. CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile
Elastic Security Labs discovered PIPEDANCE, a previously unknown Windows backdoor leveraging named pipes for lateral movement and post-compromise command & control within compromised networks. The malware supports 20+ functions including interactive shells, process injection (thread hijacking and Heaven's Gate), file/process discovery, and multi-protocol connectivity checks (DNS, ICMP, TCP, HTTP). PIPEDANCE was observed in active intrusions against Vietnamese organizations, deploying Cobalt Strike through process injection into legitimate Windows binaries.
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile
Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727. CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile
Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php. CVSSv3.1 8.1 (HIGH) · EPSS 74th percentile
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well. CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarrie CVSSv3.1 9.1 (CRITICAL) · EPSS 57th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection. This issue affects SDD-Baro: before 2.8.432. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection. This issue affects Online Services Software: before 1.17. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile
The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter. CVSSv3.1 8.8 (HIGH) · EPSS 79th percentile
A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 97th percentile
Elastic Security Labs disclosed a flaw in Windows Protected Process Light (PPL) that allows attackers running as SYSTEM to modify the security tokens of protected anti-malware processes, effectively neutering them without termination. The attack exploits a documentation discrepancy in OpenProcessToken and the absence of trust labels on PPL token security descriptors, enabling privilege and integrity level reduction. Microsoft classified the issue as moderate severity and declined to issue a security update, though Elastic has released PPLGuard mitigation code and incorporated fixes into their own products.
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 56th percentile
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. CVSSv3.1 9.8 (CRITICAL) · EPSS 67th percentile