Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 18:36Z
2022-08-03
2022-08-03 00:00Z
HIGH

Elastic Security uncovers BLISTER malware campaign

Elastic Security Labs·elastic.coin the wild

Elastic Security identified an active malware campaign leveraging BLISTER, a novel malware loader signed with a valid code-signing certificate issued to a front company. The loader uses process injection, DLL masquerading, and sandbox evasion techniques to deliver payloads like CobaltStrike and BitRat, establishing persistence via startup folders. Elastic provided YARA rules, IoCs, and detection queries to help defenders identify and stop the intrusions.

SRFApplicationSRFOsTACTA0005TACTA0003OSWindowsSWBlisterVNDElasticTYPResearch
72
Edit Score
2022-08-01
2022-08-01 20:15Z
CRIT

CVE-2022-31321 — Boltcms Bolt: The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-31321

The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via a crafted input. CVSSv3.1 9.1 (CRITICAL) · EPSS 50th percentile

CWECWE 20VNDBoltVNDBoltcmsTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2022-07-29
2022-07-29 13:15Z
CRIT

CVE-2022-1277 — Inavitas Solar_log: Solar Log product has an unauthenticated SQL Injection vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1277

Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability. CVSSv3.1 9.4 (CRITICAL) · EPSS 52th percentile

CWECWE 89VNDInavitasTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2022-07-28
2022-07-28 21:15Z
CRIT

CVE-2021-41556 — Squirrel-lang Squirrel: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41556

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScr CVSSv3.1 10.0 (CRITICAL) · EPSS 85th percentile

CWECWE 125VNDFedoraprojectVNDSquirrel LangTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2022-07-28
2022-07-28 02:15Z
HIGH

CVE-2022-2294 — Google Chrome: Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2294in the wild

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 787VNDGoogleVNDFedoraprojectTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
100
Edit Score
2022-07-25
2022-07-25 21:15Z
CRIT

CVE-2022-35131 — Joplinapp Joplin: v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. CVSSv3.1 9.0 (CRITICAL) · EPSS 79th percentile

CWECWE 79VNDJoplinVNDJoplinappTYPVulnerability
9.0
CVSS v3.1
96
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-2444 — Themeisle Visualizer: The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2444

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also presen CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile

CWECWE 502VNDThemeisleVNDVisualizerTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-2443 — Freemind_wp_browser_project Freemind_wp_browser: The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2443

The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

CWECWE 352VNDFreemind Wp Browser ProjectVNDFreemindTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-18
2022-07-18 17:15Z
CRIT

CVE-2022-2437 — Slickremix Feed_them_social: The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2437

The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacke CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 502VNDSlickremixVNDFeedTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-2435 — Anymind Anymind_widget: The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2435

The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile

CWECWE 352VNDAnymindTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-2039 — Livesupporti Free_live_chat_support: The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2039

The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 352VNDLivesupportiVNDFreeTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-2001 — Devrix Dx_share_selection: The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2001

The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile

CWECWE 352VNDDevrixVNDShareTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-1912 — Smartsoft Button_widget_smartsoft: The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1912

The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile

CWECWE 352VNDSmartsoftVNDButtonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-18
2022-07-18 17:15Z
HIGH

CVE-2022-1565 — Wpallimport Wp_all_import: The plugin WP All Import is vulnerable to arbitrary file uploads due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1565

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. CVSSv3.1 7.2 (HIGH) · EPSS 98th percentile

CWECWE 434VNDWpallimportVNDImportTYPVulnerability
7.2
CVSS v3.1
100
Edit Score
2022-07-15
2022-07-15 14:15Z
CRIT

CVE-2022-35409 — Arm Mbed_tls: This can cause a server crash or possibly information disclosure based on error responses.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-35409

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the c CVSSv3.1 9.1 (CRITICAL) · EPSS 84th percentile

CWECWE 125VNDArmVNDTrustedfirmwareTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2022-07-15
2022-07-15 12:15Z
HIGH

CVE-2022-32119 — Arox School_erp_pro: School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32119

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php. CVSSv3.1 8.8 (HIGH) · EPSS 78th percentile

CWECWE 434VNDAroxTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2022-07-14
2022-07-14 14:15Z
HIGH

CVE-2022-30024 — Tp-link Tl-wr841_firmware: A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30024

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the System Tools of the Wi-Fi network. This affects TL-WR841 V12 TL-WR841N(EU)_V12_160624 and TL-WR841 V11 TL-WR841N(EU)_V11_160325 , TL-WR841N_V11_150616 and TL-WR841 V10 TL-WR841N_V10_150310 are also affected. CVSSv3.1 8.8 (HIGH) · EPSS 80th percentile

CWECWE 120VNDTp LinkTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2022-07-13
2022-07-13 21:15Z
HIGH

CVE-2022-32114 — Strapi Strapi: An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can c CVSSv3.1 8.8 (HIGH) · EPSS 72th percentile

CWECWE 434VNDStrapiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-13
2022-07-13 00:00Z
HIGH

A peek behind the BPFDoor

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs published a comprehensive reverse-engineering analysis of BPFDoor, a sophisticated Linux backdoor attributed to Chinese APT group Red Menshen. The malware uses Berkeley Packet Filters (BPF) to passively listen for magic packets on raw sockets, establishes persistence via process spoofing and timestomping, and achieves C2 by hijacking legitimate service connections through iptables redirection. The threat has been in active development and deployment for 5+ years across telecommunications, government, logistics, and education sectors in the Middle East and Asia.

SRFOsTACTA0005SRFNetworkTACTA0003TACTA0011OSLinuxSWBpfdoorVNDElastic
82
Edit Score
2022-07-12
2022-07-12 14:15Z
HIGH

CVE-2021-38289 — Novastar Novaicare: An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-38289

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 732VNDNovastarTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-07-07
2022-07-07 19:15Z
MED

CVE-2022-33098 — Magnolia-cms Magnolia_cms: Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-33098

Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture. CVSSv3.1 6.1 (MEDIUM) · EPSS 99th percentile

CWECWE 79VNDMagnolia CmsVNDMagnoliaTYPVulnerability
6.1
CVSS v3.1
96
Edit Score
2022-07-07
2022-07-07 13:15Z
CRIT

CVE-2022-32207 — Haxx Curl: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32207

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 276CWECWE 840VNDFedoraprojectVNDNetappVNDHaxxTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-07-07
2022-07-07 13:15Z
MED

CVE-2022-32206 — Haxx Curl: The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32206

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or tr CVSSv3.1 6.5 (MEDIUM) · EPSS 98th percentile

CWECWE 770VNDFedoraprojectVNDHaxxTYPVulnerability
6.5
CVSS v3.1
92
Edit Score
2022-07-07
2022-07-07 13:15Z
MED

CVE-2022-32205 — Haxx Curl: Due to cookie matching rules, a server on `foo.example.com` can set cookies that also

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32205

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the s CVSSv3.1 4.3 (MEDIUM) · EPSS 98th percentile

CWECWE 770VNDFedoraprojectVNDNetappVNDHaxxTYPVulnerability
4.3
CVSS v3.1
80
Edit Score
2022-07-06
2022-07-06 19:15Z
CRIT

CVE-2022-33047 — Otfcc_project Otfcc: v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-33047

OTFCC v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile

CWECWE 787VNDOtfcc ProjectVNDOtfccTYPVulnerability
9.8
CVSS v3.1
99
Edit Score