Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 19:46Z
2022-06-13
2022-06-13 13:15Z
HIGH

CVE-2022-1900 — Copify Copify: The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1900

The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 34th percentile

CWECWE 352VNDCopifyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-06-10
2022-06-10 20:15Z
HIGH

CVE-2022-25863 — Gatsbyjs Gatsby-plugin-mdx: The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-25863

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an CVSSv3.1 8.1 (HIGH) · EPSS 80th percentile

CWECWE 502VNDGatsbyjsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-06-09
2022-06-09 04:15Z
HIGH

CVE-2022-30075 — Tp-link Archer_ax50_firmware: In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

VNDTp LinkVNDLinkTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2022-06-08
2022-06-08 00:00Z
HIGH

Going Coast to Coast - Climbing the Pyramid with the Deimos Implant

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs published a comprehensive analysis of the Deimos implant, a sophisticated remote access trojan actively developed since 2020 and linked to Jupyter Infostealer, SolarMarker, and Yellow Cockatoo campaigns. The malware employs multi-layered obfuscation (XOR encryption, Base64 encoding, runtime-generated variables), digitally signed lure files, and persistence mechanisms via registry shell handlers and startup shortcuts. Elastic successfully took down the observed C2 infrastructure (IP 216.230.232.134) and released detection rules and hunting techniques using the Pyramid of Pain framework to help defenders identify the implant.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0003OSWindowsSWDeimosVNDElastic
78
Edit Score
2022-06-07
2022-06-07 00:00Z
HIGH

FORMBOOK Adopts CAB-less Approach

Elastic Security Labs·elastic.coCVE-2021-40444

Elastic Security Labs analyzed a FORMBOOK information-stealing campaign leveraging CVE-2021-40444 (MSHTML RCE) across three distinct phases: testing, production, and generic phishing variants. The campaign used shared infrastructure (104.244.78.177) to deliver malicious Office documents containing obfuscated JavaScript that exploited the vulnerability to execute DLL payloads via ActiveX controls and directory traversal. After patching became effective, the threat actor shifted to traditional phishing with FORMBOOK attachments, demonstrating operational adaptation.

SRFApplicationTACTA0005TACTA0001TACTA0002SRFWebSWFormbookVNDMicrosoftTYPResearch
68
Edit Score
2022-06-06
2022-06-06 23:15Z
HIGH

CVE-2022-27438 — Caphyon Advanced_installer: Ltd Advanced Installer 19.3 and earlier and many products that use the updater

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check. CVSSv3.1 8.1 (HIGH) · EPSS 82th percentile

CWECWE 494VNDCaphyonVND3cxVNDBoomTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-06-06
2022-06-06 22:15Z
CRIT

CVE-2022-32511 — Jmespath Jmespath: jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-32511

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile

VNDFedoraprojectVNDJmespathTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-06-02
2022-06-02 19:15Z
CRIT

CVE-2021-42875 — Totolink Ex1200t_firmware: EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42875

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-06-02
2022-06-02 18:15Z
CRIT

CVE-2022-29704 — Browsbox Brows_box: CMS v4.0 was discovered to contain a SQL injection vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29704

BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability. CVSSv3.1 9.8 (CRITICAL) · EPSS 64th percentile

CWECWE 89VNDBrowsboxTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2022-31340 — Argie Simple_inventory_system: Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-31340

Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile

CWECWE 89VNDSimpleVNDArgieTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2022-30490 — Badminton_center_management_system_project Badminton_center_management_system: Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30490

Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in /bcms/admin/court_rentals/update_status.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile

CWECWE 89VNDBadminton Center Management System ProjectVNDBadmintonTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-06-02
2022-06-02 14:15Z
HIGH

CVE-2022-30034 — Flower_project Flower: Flower, a web UI for the Celery Python RPC framework, all versions as of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30034

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. CVSSv3.1 8.6 (HIGH) · EPSS 68th percentile

CWECWE 287VNDFlower ProjectVNDFlowerTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2022-28945 — Webbank Webcube: An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28945

An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file. CVSSv3.1 9.8 (CRITICAL) · EPSS 78th percentile

CWECWE 22VNDWebbankTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-06-02
2022-06-02 14:15Z
HIGH

CVE-2022-27778 — Haxx Curl: A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-27778

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. CVSSv3.1 8.1 (HIGH) · EPSS 90th percentile

CWECWE 706VNDNetappVNDHaxxTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2022-24240 — Aceware Aceweb_online_portal: ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-24240

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 89VNDAcewareVNDAcewebTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2022-24239 — Aceware Aceweb_online_portal: ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-24239

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile

CWECWE 434VNDAcewareVNDAcewebTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2022-06-02
2022-06-02 14:15Z
CRIT

CVE-2021-42872 — Totolink Ex1200t_firmware: EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42872

TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-06-02
2022-06-02 00:00Z
CRIT

Detection and response for the actively exploited ProxyShell vulnerabilities

Elastic Security Labs·elastic.coCVE-2021-31207CVE-2021-34473CVE-2021-34523in the wild

Elastic Security Labs published detection and response guidance for the actively exploited ProxyShell vulnerability chain (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523) affecting Microsoft Exchange servers. The three vulnerabilities, chained together, allow unauthenticated remote code execution and are being weaponized in the wild for ransomware deployment and enterprise network compromise.

SRFApplicationTACTA0001TACTA0002SRFWebSWExchangeVNDMicrosoftTYPVulnerabilityTYPThreat Intel
72
Edit Score
2022-06-02
2022-06-02 00:00Z
INFO

Testing your Okta visibility and detection with Dorothy and Elastic Security

Elastic Security Labs·elastic.co

Elastic Security Labs released Dorothy, a free open-source tool designed to help security teams test their visibility and detection capabilities in Okta SSO environments. Dorothy includes 25+ modules mapped to MITRE ATT&CK tactics (Discovery, Persistence, Defense Evasion, Impact) that simulate attacker behavior in Okta, and the post demonstrates how to use Dorothy alongside Elastic's free detection rules to validate monitoring and alerting.

TACTA0005TACTA0007SRFIdentityTACTA0003SRFCloudSWElasticSWDorothyVNDOkta
68
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Collecting and operationalizing threat data from the Mozi botnet

Elastic Security Labs·elastic.co

Elastic Security Labs published a comprehensive walkthrough of collecting, analyzing, and operationalizing threat intelligence from the Mozi botnet—an active IoT malware campaign targeting SOHO devices via weak credentials and public exploits. The post demonstrates practical techniques for unpacking UPX-compressed ARM ELF binaries with anti-analysis protections, extracting indicators via static analysis, and enriching ThreatFox data into Elasticsearch for visualization and clustering of C2 infrastructure across 24+ countries.

SRFNetwork ApplianceTACTA0043SWMoziTYPResearchTYPThreat IntelSTGDiscoverySTGReconTECT1598
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Ransomware, interrupted: Sodinokibi and the supply chain

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs prevented a targeted Sodinokibi ransomware attack against an MSP customer by detecting and blocking process injection attempts. The attack chain leveraged ScreenConnect remote desktop software (accessed via a compromised upstream MSP) to deploy a Base64-encoded PowerShell script that attempted to download and inject ransomware from Pastebin. All six endpoint compromise attempts were blocked through behavior-based detection of process injection and fileless attack patterns.

SRFApplicationTACTA0005TACTA0001TACTA0002SRFSupply ChainSWScreenconnectSWSodinokibiVNDElastic
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Okta and LAPSUS$: What you need to know

Elastic Security Labs·elastic.coin the wild

LAPSUS$ group breached Okta's systems in January 2022, gaining access to administrative and customer tools with ability to reset passwords and MFA tokens for 2.5% of the customer base. The group used social engineering and spear phishing to target Okta, not for direct system compromise but to access Okta customers' accounts. Elastic provides threat hunting guidance and Okta log analysis queries to detect suspicious activity including MFA resets, email updates, privilege grants, and user impersonation.

TACTA0001TACTA0006SRFIdentitySRFCloudVNDOktaTYPThreat IntelTYPNewsSTGInitial Access
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Nimbuspwn: Leveraging vulnerabilities to exploit Linux via Privilege Escalation

Elastic Security Labs·elastic.coCVE-2022-29799CVE-2022-29800

Nimbuspwn is a collection of privilege escalation vulnerabilities in networkd-dispatcher affecting Linux systems, comprising directory traversal, symlink race, and TOCTOU race conditions. Microsoft 365 Defender identified the issues and coordinated patches with the upstream maintainer. Elastic Security Labs provides detection rules and remediation guidance for organizations running vulnerable versions.

SRFOsTACTA0004OSLinuxSWNetworkd DispatcherVNDMicrosoftTYPResearchTYPVulnerabilitySTGPrivesc
68
Edit Score
2022-06-01
2022-06-01 20:15Z
HIGH

CVE-2022-30190 — Microsoft Windows_10_1507: A remote code execution vulnerability exists when MSDT is called using the URL protocol

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30190in the wild

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to CVSSv3.1 7.8 (HIGH) · EPSS 100th percentile

VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
100
Edit Score
2022-06-01
2022-06-01 00:00Z
HIGH

Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)

Elastic Security Labs·elastic.co

Elastic Security Labs published a threat hunting guide demonstrating how to detect WMI Event Subscription persistence (T1084) using Elastic Endpoint and SIEM. The post explains the mechanics of WMI abuse, provides EQL queries for hunting malicious subscriptions, and walks through detection workflows including template-based hunts and custom rule creation in Elastic SIEM.

SRFApplicationSRFOsTACTA0003SWElastic SecuritySWElastic EndpointSWElastic SiemVNDElasticTYPResearch
68
Edit Score