Windows Common Log File System Driver Elevation of Privilege Vulnerability CVSSv3.1 7.8 (HIGH) · EPSS 98th percentile
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile
Elastic Security Labs released detection logic and Auditd rules for CVE-2022-0847 (Dirty Pipe), a Linux kernel local privilege escalation vulnerability affecting kernels 5.8+ through 5.16.10, 5.15.24, and 5.10.101. The vulnerability exploits improper initialization of the PIPE_BUF_FLAG_CAN_MERGE flag in pipe buffer structures, allowing unprivileged users to overwrite read-only files (e.g., /etc/passwd) or inject code into SUID binaries. Elastic provides Auditd rules targeting splice syscalls with specific argument patterns, integration guidance for Elastic Agent/Auditbeat/Filebeat, and KQL/EQL queries for detection in Kibana.
Elastic Security Labs published a technical guide on extracting and analyzing Cobalt Strike beacon configurations from binary payloads and memory. The post demonstrates using the Cobalt Strike Configuration Extractor (CSCE) tool to recover atomic indicators (C2 domains, IPs, encryption keys, watermarks, license IDs) that enable clustering of threat actor infrastructure and campaigns across multiple beacons.
Elastic Security Labs published a comprehensive technical analysis of BUGHATCH, a custom C2 implant deployed during CUBA ransomware campaigns in February 2022. The malware is a multithreaded in-memory implant capable of arbitrary code execution via multiple techniques including reflective PE loading, shellcode injection, PowerShell/CMD execution, and process migration, communicating via HTTP(S) with 2-byte XOR encryption layered atop SSL. The analysis includes detailed reverse-engineering of the execution flow, command protocol, encryption scheme, and provides YARA detection rules and MITRE ATT&CK mappings.
Elastic Security Labs published a detailed technical analysis of HERMETICWIPER, a destructive data-wiping malware that targeted Ukrainian organizations starting February 2022. The malware abuses a legitimate EaseUS Partition Manager driver (epmntdrv.sys) to gain raw disk access, corrupt boot sectors and file system metadata, and render systems unrecoverable. Elastic provides YARA rules, detection signatures, and observables for identifying the malware.
Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote authenticated attackers the ability to modify values in the vulnerable parameter. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile
Elastic Security Labs published a comprehensive analysis of the CUBA ransomware campaign targeting North American and European retailers and manufacturers. The threat group leverages ProxyLogon/ProxyShell Exchange vulnerabilities for initial access, establishes persistence via hidden user accounts and RDP, and deploys a toolkit including Metasploit, Cobalt Strike, Mimikatz, SystemBC, and NetSupport for lateral movement, credential harvesting, and data exfiltration before deploying ransomware with extortion demands.
NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameters. CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile
The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file that is called via the doAjax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile
The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file that is called via the doAjax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into per CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the admin_page function found in the ~/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on CVSSv3.1 8.8 (HIGH) · EPSS 40th percentile
The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due to missing nonce validation on the stockist_settings_main() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site. CVSSv3.1 5.3 (MEDIUM) · EPSS 95th percentile
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the CVSSv3.1 8.8 (HIGH) · EPSS 78th percentile
The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP CVSSv3.1 8.8 (HIGH) · EPSS 90th percentile
The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabc_admin_slides_postback() function found in the ~/admin/admin.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and aut CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile
Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low pr CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile
Elastic Security Labs published a comprehensive technical analysis of LUNA ransomware, a Rust-based cross-platform variant first identified by Kaspersky in July 2022. The research dissects execution chains, encryption mechanisms, and behavioral differences between Windows and Linux variants, revealing that the Windows implementation is significantly more mature with proper OS-aware safeguards, while the Linux variant contains vestigial Windows code and lacks critical system-file protections. The malware uses x25519 elliptic-curve key exchange with AES-CTR encryption, hardcoded initialization vectors, and employs service/process termination to disable security products.