Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 13:41Z
2023-01-26
2023-01-26 00:00Z
HIGH

Finding Truth in the Shadows

Elastic Security Labs·elastic.co

Elastic Security Labs analyzes Windows Hardware Stack Protection (HSP), a hardware-backed exploit mitigation using Intel CET and AMD Shadow Stack to prevent ROP attacks. Beyond exploit mitigation, the research demonstrates three additional benefits: improved debugging of stack corruption, potential performance gains for kernel-mode stack walking, and a novel detection technique (ShadowStackWalk PoC) that defeats thread stack spoofing defenses like ThreadStackSpoofer and CallStackSpoofer.

SRFOsTACTA0005OSWindowsVNDMicrosoftVNDIntelVNDAmdTYPResearchSTGDefense Evasion
72
Edit Score
2023-01-20
2023-01-20 12:15Z
HIGH

CVE-2021-37500 — Reprisesoftware Reprise_license_manager: Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-37500

Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server. CVSSv3.1 8.1 (HIGH) · EPSS 65th percentile

CWECWE 22VNDReprisesoftwareTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2023-01-19
2023-01-19 00:00Z
CRIT

Vulnerability summary: Follina, CVE-2022-30190

Elastic Security Labs·elastic.coCVE-2022-30190in the wild

Follina (CVE-2022-30190) is a critical remote code execution vulnerability in Microsoft Support Diagnostic Tool (MSDT) exploitable via weaponized Office documents using the ms-msdt URI handler in template injection attacks. The vulnerability does not require macros to be enabled and was first disclosed in May 2022 via a VirusTotal sample. Elastic Security Labs released detection signatures and updated threat hunting rules to identify exploitation attempts by monitoring msdt.exe as a child process of Office applications.

SRFApplicationSRFOsTACTA0001TACTA0002SWMsdtVNDMicrosoftTYPVulnerabilityTYPThreat Intel
72
Edit Score
2023-01-18
2023-01-18 18:15Z
CRIT

CVE-2022-47966 — Zohocorp Manageengine_access_manager_plus: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-47966in the wild

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus b CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 20VNDZohoVNDZohocorpTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2023-01-13
2023-01-13 20:15Z
HIGH

CVE-2023-0294 — Frenify Mediamatic: The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-0294

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unauthenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 31th percentile

CWECWE 352VNDFrenifyVNDMediamaticTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-01-13
2023-01-13 19:15Z
HIGH

CVE-2023-22491 — Gatsbyjs Gatsby-transformer-remark: The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-22491

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected J CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile

CWECWE 89CWECWE 20CWECWE 79VNDGatsbyjsVNDGatsbyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2023-01-10
2023-01-10 14:15Z
CRIT

CVE-2022-4422 — Bulutses Bulutdesk_callcenter: Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-4422

Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0 CVSSv3.1 9.8 (CRITICAL) · EPSS 53th percentile

CWECWE 89VNDBulutsesVNDCallTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2023-01-10
2023-01-10 14:15Z
CRIT

CVE-2022-3792 — Gullseye Gullseye_terminal_operating_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3792

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL Injection. This issue affects GullsEye terminal operating system: from unspecified before 5.0.13. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile

CWECWE 89VNDGullseyeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-01-05
2023-01-05 19:15Z
HIGH

CVE-2023-0088 — Swifty_page_manager_project Swifty_page_manager: The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-0088

The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 352VNDSwifty Page Manager ProjectVNDSwiftyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-01-04
2023-01-04 00:00Z
INFO

FLARE-ON 9 Solutions:

Elastic Security Labs·elastic.co

Elastic Security Labs published detailed solutions to all 11 challenges from the FLARE-ON 9 reverse engineering competition, covering techniques including JavaScript deobfuscation, binary patching, C++ VTABLE reconstruction, .NET dynamic IL manipulation, and DNS-based C2 command parsing. The writeup demonstrates practical malware analysis methodologies including debugger-assisted patching, state machine reversal, and dynamic code generation exploitation.

SRFApplicationTYPResearchTYPWriteupTECT1036TECT1140TECT1027EXPRceEXPDeserialization
72
Edit Score
2023-01-03
2023-01-03 00:00Z
HIGH

Google Workspace Attack Surface

Elastic Security Labs·elastic.co

Elastic Security Labs publishes a comprehensive survey of Google Workspace attack surface, covering administration, organizational structure, IAM, and developer resources. The article maps common threat techniques (phishing, credential theft, data exfiltration, C2) to specific GW services including Gmail, Drive, Docs, Sheets, and Apps Script, highlighting misconfigurations in access controls, service account credential exposure, and abuse of native applications for malicious purposes.

TACTA0005TACTA0001TACTA0006TACTA0007SRFIdentitySRFWebTACTA0003SRFCloud
72
Edit Score
2022-12-25
2022-12-25 06:15Z
HIGH

CVE-2022-42898 — Mit Kerberos_5: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-42898

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug." CVSSv3.1 8.8 (HIGH) · EPSS 94th percentile

CWECWE 190VNDMitVNDHeimdal ProjectTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2022-12-23
2022-12-23 15:15Z
HIGH

CVE-2022-43551 — Haxx Curl: A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-43551

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHI CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile

CWECWE 319VNDFedoraprojectVNDNetappVNDHaxxTYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2022-12-22
2022-12-22 21:15Z
HIGH

CVE-2022-3805 — Jegtheme Jeg_elementor_kit: The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3805

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements. CVSSv3.1 8.6 (HIGH) · EPSS 92th percentile

CWECWE 639VNDJegthemeVNDJegTYPVulnerability
8.6
CVSS v3.1
96
Edit Score
2022-12-22
2022-12-22 20:15Z
CRIT

CVE-2022-26486 — Mozilla Firefox: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-26486in the wild

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVSSv3.1 9.6 (CRITICAL) · EPSS 82th percentile

CWECWE 416VNDMozillaVNDWebgpuTYPVulnerabilitySTAitw exploited
9.6
CVSS v3.1
99
Edit Score
2022-12-22
2022-12-22 20:15Z
HIGH

CVE-2022-26485 — Mozilla Firefox: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-26485in the wild

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 416VNDMozillaVNDRemovingTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
98
Edit Score
2022-12-19
2022-12-19 22:15Z
CRIT

CVE-2022-40434 — Softr Softr: v2.0 was discovered to be vulnerable to HTML injection via the Name field

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-40434

Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page. CVSSv3.1 9.8 (CRITICAL) · EPSS 67th percentile

CWECWE 79VNDSoftrTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-12-16
2022-12-16 00:00Z
CRIT

SiestaGraph: New implant uncovered in ASEAN member foreign ministry

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed an ongoing intrusion against a Southeast Asian foreign ministry's Exchange server involving multiple threat actors deploying SiestaGraph, a custom .NET backdoor leveraging Microsoft Graph API for C2, alongside DoorMe IIS modules, web shells, and DLL side-loading techniques. The attackers exported 24 targeted mailboxes from ASEAN-related personnel, performed lateral movement to domain controllers and workstations, and deployed kernel-mode driver exploitation (mhyprot.sys) for process monitoring and evasion. The intrusion likely began in September 2022 and was ongoing as of December 2022, with evidence of active operator involvement and multiple independent threat actors or coordinated groups.

SRFApplicationTACTA0004TACTA0005TACTA0001TACTA0002SRFNetworkTACTA0006TACTA0007
88
Edit Score
2022-12-15
2022-12-15 23:15Z
CRIT

CVE-2022-46393 — Arm Mbed_tls: There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-46393

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. CVSSv3.1 9.8 (CRITICAL) · EPSS 76th percentile

CWECWE 125CWECWE 787VNDFedoraprojectVNDArmVNDTrustedfirmwareTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-12-15
2022-12-15 19:15Z
HIGH

CVE-2022-3427 — Dwbooster Corner_ad: The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3427

The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 69th percentile

CWECWE 352VNDDwboosterVNDCornerTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-12-14
2022-12-14 21:15Z
HIGH

CVE-2022-2601 — Gnu Grub2: A buffer overflow was found in grub_font_construct_glyph().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2601

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. CVSSv3.1 8.6 (HIGH) · EPSS 19th percentile

CWECWE 787CWECWE 122VNDGnuVNDFedoraprojectTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2022-12-14
2022-12-14 20:10Z
INFO

Volatility 3 2.4.0

Volatility3 releases·github.com

Volatility 3 2.4.0 released with new plugins for Linux and Windows memory analysis (mountinfo, psaux, devicetree, joblinks, ldrmodules, mbrscan, mftscan, sessions), improved symbol handling, better QEMU support, and API enhancements for PDB symbol table integration.

SRFOsVNDVolatilityTYPToolSTGDiscovery
45
Edit Score
2022-12-14
2022-12-14 15:15Z
CRIT

CVE-2022-31358 — Proxmox Virtual_environment: A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-31358

A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/. CVSSv3.1 9.0 (CRITICAL) · EPSS 66th percentile

CWECWE 79VNDProxmoxVNDXssTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2022-12-12
2022-12-12 13:15Z
CRIT

CVE-2022-37897 — Arubanetworks Sd-wan: Successful exploitation of this vulnerability results in the ability to execute arbitrary code as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-37897

There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile

CWECWE 78VNDThereVNDArubanetworksTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-08
2022-12-08 22:15Z
CRIT

CVE-2022-33186 — Broadcom Fabric_operating_system: A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-33186

A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP address. CVSSv3.1 9.8 (CRITICAL) · EPSS 76th percentile

CWECWE 78VNDBroadcomVNDBrocadeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score