Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile
Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote). CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who succ CVSSv3.1 8.1 (HIGH) · EPSS 79th percentile
Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security_5g parameter in the function formWifiBasicSet. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
Elastic Security Labs analyzed a Malaysian-targeted APT campaign attributed with moderate confidence to APT40/Leviathan. The attack chain uses spear-phishing with Word documents containing remote template injection, VBA macro execution, embedded DLL side-loading of a benign Logitech application, and a second-stage in-memory backdoor with AES encryption and dynamic DNS C2.
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some ope CVSSv3.1 7.3 (HIGH) · EPSS 100th percentile
A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code. CVSSv3.1 8.2 (HIGH) · EPSS 17th percentile
Elastic Security Labs publishes a two-part threat hunting guide focused on detecting Windows persistence techniques: scheduled tasks (T1053) and BITS jobs (T1197). The post provides EQL queries, real-world examples from APT34 and Qbot malware, and detection logic for identifying abuse of schtasks.exe, PowerShell ScheduledTask cmdlets, bitsadmin.exe, and BITS PowerShell cmdlets.
Elastic Security Labs published a comprehensive technical guide on memory-resident malware techniques and detection methods. The article catalogs six major in-memory attack primitives (shellcode injection, reflective DLL injection, memory module, process hollowing, module overwriting, and Gargoyle/ROP-APC), provides forensic indicators for each, and describes both open-source (Get-InjectedThreads) and enterprise detection approaches. The research emphasizes that memory-based evasion has evolved from advanced-adversary-only tactics to commodity techniques across all threat levels.
Elastic Security Labs documents emerging .NET in-memory attack techniques used by adversaries to evade endpoint detection, focusing on Assembly.Load() abuse for memory-only code execution. The post presents both on-demand hunting methods (Get-ClrReflection PowerShell function) and real-time detection via ClrGuard, a CLR hook that monitors LoadImage() calls to intercept malicious .NET module loading.
Elastic Security Labs published an in-depth analysis of Gamaredon Group's ongoing campaign targeting Ukrainian government officials since August 2019. The campaign uses spearphishing with malicious Word documents leveraging remote template injection to deliver obfuscated VBA macros that establish reverse shells, persist via startup folder VBScript execution, and communicate via Dynamic DNS infrastructure. The post includes detection strategies using Elastic Query Language (EQL) and notes an observed evolution toward .NET-based payloads in their Pteranodon backdoor.
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). CVSSv3.1 9.8 (CRITICAL) · EPSS 67th percentile
JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts. CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile
Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile
The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1. CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile
The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 42th percentile