Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 14:19Z
2022-12-12
2022-12-12 13:15Z
CRIT

CVE-2022-37897 — Arubanetworks Sd-wan: Successful exploitation of this vulnerability results in the ability to execute arbitrary code as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-37897

There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile

CWECWE 78VNDThereVNDArubanetworksTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-08
2022-12-08 22:15Z
CRIT

CVE-2022-33186 — Broadcom Fabric_operating_system: A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-33186

A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP address. CVSSv3.1 9.8 (CRITICAL) · EPSS 76th percentile

CWECWE 78VNDBroadcomVNDBrocadeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-12-07
2022-12-07 00:00Z
HIGH

Get-InjectedThreadEx – Detecting Thread Creation Trampolines

Elastic Security Labs·elastic.co

Elastic Security Labs released Get-InjectedThreadEx, an updated PowerShell detection script that identifies four classes of thread-creation trampolines used by malware to evade the original Get-InjectedThread detection. The research demonstrates detection methods for hooked start addresses, hijacked call stacks, Control Flow Guard (CFG) gadget abuse, and CRT function misuse, along with additional heuristics for suspicious thread prologs and epilogs.

SRFOsTACTA0005OSWindowsTYPResearchTYPToolSTGDefense EvasionSTGExecutionTECT1134
72
Edit Score
2022-12-06
2022-12-06 00:00Z
HIGH

BPFDoor Configuration Extractor

Elastic Security Labs·elastic.co

Elastic Security Labs released a Python-based configuration extractor tool for BPFDoor malware that dumps hardcoded credentials from infected samples. The tool supports both single-file and batch directory scanning via CLI or Docker, complementing Elastic's prior BPFDoor analysis and scanner releases.

SRFOsTACTA0007SWBpfdoorVNDElasticTYPToolSTGDiscovery
62
Edit Score
2022-12-06
2022-12-06 00:00Z
HIGH

BPFDoor Scanner

Elastic Security Labs·elastic.co

Elastic Security Labs released BPFDoor Scanner, a Python tool to identify hosts infected with BPFDoor malware. The scanner sends discovery packets to suspected endpoints and listens for responses, supporting both local and containerized deployment with configurable target/source IPs and ports.

SRFOsTACTA0007OSLinuxSWBpfdoorVNDElasticTYPToolSTGDiscovery
72
Edit Score
2022-12-06
2022-12-06 00:00Z
CRIT

Operation Bleeding Bear

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs analyzed Operation Bleeding Bear, a destructive multi-stage malware campaign targeting Ukrainian government entities in January 2022. The WhisperGate malware employs MBR wiping, Windows Defender tampering, process hollowing via InstallUtil, and file corruption across targeted file extensions, with no ransom recovery intent—indicating a destructive rather than financial attack. Elastic's endpoint protection detects and prevents each stage through behavioral analysis of MBR writes, malware execution, and ransomware indicators.

SRFOsTACTA0005TACTA0040OSWindowsVNDElasticTYPVulnerabilityTYPThreat IntelSTGDefense Evasion
78
Edit Score
2022-12-06
2022-12-06 00:00Z
HIGH

Exploring the REF2731 Intrusion Set

Elastic Security Labs·elastic.co

Elastic Security Labs published a detailed technical analysis of the REF2731 intrusion set, which deploys the PARALLAX loader to deliver the NETWIRE RAT via macro-enabled Word documents. The five-stage attack chain leverages DLL side-loading (MsiDb.exe), syscall-based process injection, steganographic PNG obfuscation, and UAC bypass via CMSTPLUA COM interface. Two distinct campaigns were identified sharing infrastructure (C2 domain ohioohioa[.]com) and TTPs, with indicators suggesting possible overlap with financially-motivated threat groups like Evilnum.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0011SWNetwireSWParallax
78
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-12-05
2022-12-05 22:15Z
CRIT

CVE-2022-32224 — Activerecord_project Activerecord: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 502VNDRceVNDActiverecord ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-05
2022-12-05 22:15Z
CRIT

CVE-2022-32221 — Haxx Curl: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32221

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile

CWECWE 200CWECWE 668VNDNetappVNDHaxxTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-02
2022-12-02 20:15Z
CRIT

CVE-2022-44945 — Rukovoditel Rukovoditel: v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-44945

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile

CWECWE 89VNDRukovoditelTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-12-02
2022-12-02 20:15Z
CRIT

CVE-2022-44291 — Webtareas_project Webtareas: 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-44291

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 89VNDWebtareas ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-02
2022-12-02 20:15Z
CRIT

CVE-2022-44290 — Webtareas_project Webtareas: 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-44290

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 89VNDWebtareas ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-12-02
2022-12-02 12:15Z
HIGH

CVE-2022-2808 — Algan Prens_student_information_system: Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2808

Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows Object Relational Mapping Injection. This issue affects Prens Student Information System: before 2.1.11. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 639VNDAlganTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-12-02
2022-12-02 12:15Z
CRIT

CVE-2022-2807 — Algan Prens_student_information_system: SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2807

SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: before 2.1.11. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile

CWECWE 89VNDAlganTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-12-01
2022-12-01 00:00Z
HIGH

EMOTET Dynamic Configuration Extraction

Elastic Security Labs·elastic.co

Elastic Security Labs released an open-source configuration extractor for 64-bit EMOTET malware that uses code emulation to bypass runtime obfuscation techniques. The tool dynamically extracts encryption keys (ECC public keys), C2 server lists, and encoded strings by emulating malware functions rather than performing static analysis. The research demonstrates that EMOTET developers shifted from storing encrypted configs in binary sections to calculating them at runtime using Mixed Boolean-Arithmetic obfuscation.

SRFApplicationTACTA0007OSWindowsSWEmotetVNDElasticTYPResearchTYPToolSTGDiscovery
78
Edit Score
2022-11-30
2022-11-30 00:00Z
CRIT

Analysis of Log4Shell vulnerability & CVE-2021-45046

Elastic Security Labs·elastic.coCVE-2021-44228CVE-2021-45046in the wild

Elastic Security Labs analysis of Log4Shell (CVE-2021-44228) and the follow-up vulnerability CVE-2021-45046, which was introduced in Log4j 2.15.0 and allows RCE and DoS through alternative lookup code paths. The CVSS score for CVE-2021-45046 was revised from 3.7 to 9.0 after discovery that formatMsgNoLookups mitigation was insufficient; Elastic observed eight malware families and active scanning already exploiting both vulnerabilities in the wild.

SRFApplicationTACTA0002TACTA0011SWLog4jVNDElasticVNDApacheTYPVulnerabilityTYPThreat Intel
78
Edit Score
2022-11-30
2022-11-30 00:00Z
HIGH

Deep dive into the TTD ecosystem

Elastic Security Labs·elastic.co

Elastic Security Labs published a deep-dive analysis of Microsoft's Time Travel Debugging (TTD) ecosystem, reverse-engineering the ttdrecord.dll component to uncover hidden command-line options and undocumented functionality. The research discovered a PplDebuggingToken flag that, when combined with a validly-signed supplemental Code Integrity policy, can bypass Protected Process Light (PPL) restrictions on processes like LSASS, potentially allowing arbitrary process injection and memory dumping.

SRFOsTACTA0007OSWindowsSWWindbgSWTtdVNDMicrosoftTYPResearchSTGDiscovery
78
Edit Score
2022-11-30
2022-11-30 00:00Z
CRIT

KNOTWEED Assessment Summary

Elastic Security Labs·elastic.coin the wild0day

Elastic Security Labs published an assessment of KNOTWEED, a private-sector offensive actor (PSOA) group sponsored by DSIRF that deploys Subzero spyware via 0-day exploits in Adobe Reader and Windows. The group has targeted legal, financial, and NGO sectors in Europe and Latin America, using VBA-based initial access followed by modular post-exploitation components (Jumplump for persistence, Corelump for actions). Elastic provides detection rules and hunting queries for the persistence mechanisms and notes that their endpoint security prevents the VBA execution chain.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0006TACTA0007TACTA0003OSWindows
72
Edit Score
2022-11-29
2022-11-29 21:15Z
HIGH

CVE-2022-4030 — Simple-press Simple\: The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-4030

The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will subsequently be deleted. This can be used to delete the wp-config.php file that can allow an attacker to configure the site and achieve remote code CVSSv3.1 8.1 (HIGH) · EPSS 91th percentile

CWECWE 22VNDSimple PressVNDSimpleTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2022-11-29
2022-11-29 21:15Z
HIGH

CVE-2022-3898 — Tipsandtricks-hq Wp_affiliate_platform: The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3898

The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 352VNDTipsandtricks HqVNDAffiliateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-11-29
2022-11-29 21:15Z
HIGH

CVE-2022-3747 — Muffingroup Becustom: The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3747

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 77th percentile

CWECWE 352VNDMuffingroupVNDBecustomTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-11-29
2022-11-29 21:15Z
HIGH

CVE-2022-3384 — Ultimatemember Ultimate_member: The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3384

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the ser CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 94VNDUltimatememberVNDUltimateTYPVulnerability
7.2
CVSS v3.1
98
Edit Score
2022-11-29
2022-11-29 21:15Z
HIGH

CVE-2022-3383 — Ultimatemember Ultimate_member: The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-3383

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 94VNDUltimatememberVNDUltimateTYPVulnerability
7.2
CVSS v3.1
96
Edit Score
2022-11-29
2022-11-29 17:15Z
HIGH

CVE-2022-46152 — Trustedfirmware Op-tee: Therefore, an attacker in the normal world can craft an SMC call that will

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-46152

OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` a CVSSv3.1 8.2 (HIGH) · EPSS 62th percentile

CWECWE 129VNDTeeVNDTrustedfirmwareTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-11-28
2022-11-28 15:15Z
HIGH

CVE-2022-31877 — Msi Center: An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-31877

An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 345VNDMsiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score