Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 23:27Z
2022-06-01
2022-06-01 00:00Z
MED

Practical security engineering: Stateful detection

Elastic Security Labs·elastic.co

Elastic Security Labs presents a detection engineering methodology called 'stateful detection' that formalizes security monitoring across three states: creation (configuration), runtime (execution), and cleanup (covering tracks). Using T1015 (Accessibility Features abuse via Image File Execution Options) as a case study, the post demonstrates how to build EQL detection rules for each state to close detection gaps, particularly for backdoors established weeks or months prior and for attackers who sanitize their presence.

SRFOsTACTA0005TACTA0003OSWindowsTYPResearchSTGDefense EvasionSTGPersistenceTECT1547.008
72
Edit Score
2022-06-01
2022-06-01 00:00Z
HIGH

Embracing offensive tooling: Building detections against Koadic using EQL

Elastic Security Labs·elastic.co

Elastic Security Labs published a comprehensive detection engineering guide demonstrating behavioral analytics against Koadic, an open-source post-exploitation framework used by APT28. The post walks through EQL (Event Query Language) detection strategies across the attack lifecycle—from spearphishing attachment delivery through discovery, UAC bypass, and data exfiltration—with concrete query examples and process tree visualizations.

SRFOsTACTA0004TACTA0001TACTA0002TACTA0007TACTA0003TACTA0009OSWindows
72
Edit Score
2022-05-26
2022-05-26 17:15Z
HIGH

CVE-2022-22576 — Haxx Curl: An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). CVSSv3.1 8.1 (HIGH) · EPSS 57th percentile

CWECWE 306CWECWE 287VNDNetappVNDHaxxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-05-25
2022-05-25 16:15Z
HIGH

CVE-2022-27305 — Gibbonedu Gibbon: v23 does not generate a new session ID cookie after a user authenticates

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 384VNDGibboneduVNDGibbonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 18:16Z
HIGH

CVE-2022-28944 — Emcosoftware Msi_package_builder: The impact is: execute arbitrary code (remote).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28944

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. CVSSv3.1 8.8 (HIGH)

CWECWE 494VNDCertainVNDEmcosoftwareTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 16:16Z
HIGH

CVE-2022-30014 — Simple_food_website_project Simple_food_website: Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30014

Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 352VNDSimple Food Website ProjectVNDLumidekTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 16:16Z
CRIT

CVE-2022-28932 — Dlink Dsl-g2452dg_firmware: D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28932

D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile

CWECWE 276VNDDlinkVNDLinkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-05-16
2022-05-16 14:15Z
CRIT

CVE-2022-29351 — Tiddlywiki Tiddlywiki5: An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29351

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here. CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile

CWECWE 434VNDTiddlywikiTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-13
2022-05-13 13:15Z
HIGH

CVE-2020-22983 — Microstrategy Microstrategy_web: A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-22983

A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task. CVSSv3.1 8.1 (HIGH) · EPSS 81th percentile

CWECWE 918VNDMicrostrategyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-05-13
2022-05-13 08:15Z
HIGH

CVE-2022-25762 — Apache Tomcat: This could result in subsequent connections using the same object concurrently which could result

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-25762

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result i CVSSv3.1 8.6 (HIGH) · EPSS 95th percentile

CWECWE 404VNDApacheVNDOracleTYPVulnerability
8.6
CVSS v3.1
96
Edit Score
2022-05-12
2022-05-12 08:15Z
HIGH

CVE-2022-29885 — Apache Tomcat: While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29885

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 400VNDApacheTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 21:15Z
MED

CVE-2022-26934 — Microsoft 365_apps: Windows Graphics Component Information Disclosure Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-26934

Windows Graphics Component Information Disclosure Vulnerability CVSSv3.1 6.5 (MEDIUM) · EPSS 95th percentile

VNDMicrosoftTYPVulnerability
6.5
CVSS v3.1
88
Edit Score
2022-05-10
2022-05-10 20:15Z
CRIT

CVE-2022-1505 — Carrcommunications Rsvpmaker: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1505

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 89VNDCarrcommunicationsVNDRsvpmakerTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 20:15Z
MED

CVE-2022-1476 — Servmask All-in-one_wp_migration: The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1476

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key. CVSSv3.1 6.6 (MEDIUM) · EPSS 97th percentile

CWECWE 22VNDServmaskVNDOneTYPVulnerability
6.6
CVSS v3.1
94
Edit Score
2022-05-10
2022-05-10 20:15Z
CRIT

CVE-2022-1453 — Carrcommunications Rsvpmaker: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1453

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 89VNDCarrcommunicationsVNDRsvpmakerTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 20:15Z
HIGH

CVE-2022-1442 — Wpmet Metform_elementor_contact_form_builder: The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1442

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 862VNDWpmetVNDMetformTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2022-05-09
2022-05-09 08:15Z
HIGH

CVE-2022-30333 — Rarlab Unrar: before 6.12 on Linux and UNIX allows directory traversal to write to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30333in the wild

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 22CWECWE 59VNDRarlabTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 20:15Z
CRIT

CVE-2022-29155 — Openldap Openldap: In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29155

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 89VNDOpenldapTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 18:38Z
INFO

Impacket 0.10.0

Impacket releases·github.com

Impacket 0.10.0 released with significant library improvements including Python 2.7 deprecation, refactored testing infrastructure, and multiple new attack capabilities. Notable additions include MS-DSSP protocol implementation, ADCS ESC1/ESC6 attack support, Shadow Credentials attack, Kerberos Key List attack implementation, and enhanced ntlmrelayx.py with multi-relay and StartTLS support.

SRFNetworkTACTA0006SRFIdentityTACTA0008VNDImpacketTYPToolSTGDiscoverySTGCred Access
78
Edit Score
2022-05-04
2022-05-04 15:15Z
CRIT

CVE-2022-29347 — Web\@rchiv_project Web\@rchiv: An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29347

An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile

CWECWE 434VNDWeb Rchiv ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 15:15Z
CRIT

CVE-2022-28568 — Simple_doctor\'s_appointment_system_project Simple_doctor\'s_appointment_system: Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28568

Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored. CVSSv3.1 9.8 (CRITICAL) · EPSS 89th percentile

CWECWE 434VNDSourcecodesterVNDSimple Doctor S Appointment System ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 01:15Z
HIGH

CVE-2021-43164 — Ruijienetworks Reyeeos: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43164

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 78VNDCodeVNDRuijienetworksTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 01:15Z
CRIT

CVE-2021-43163 — Ruijienetworks Reyeeos: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43163

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth. CVSSv3.1 9.8 (CRITICAL) · EPSS 80th percentile

CWECWE 77VNDCodeVNDRuijienetworksTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 01:15Z
HIGH

CVE-2021-43162 — Ruijienetworks Reyeeos: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43162

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose. CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile

CWECWE 77VNDCodeVNDRuijienetworksTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2022-05-04
2022-05-04 01:15Z
HIGH

CVE-2021-43161 — Ruijienetworks Reyeeos: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43161

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch. CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile

CWECWE 77VNDCodeVNDRuijienetworksTYPVulnerability
8.8
CVSS v3.1
95
Edit Score