The Known Exploited Vulnerabilities (KEV) Catalog is an authoritative source of vulnerabilities exploited in the wild maintained by the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Vulnerabilities in the KEV Catalog are contained in the Common Vulnerabilities and Exposures (CVE®) List, which identifies and defines publicly known cybersecurity vulnerabilities. These mappings use the behaviors described in MITRE ATT&CK® to connect known exploited CVEs to publicly reported methods and impacts of adversary exploitation. Mapped ATT&CK techniques enable defenders to take a threat-informed approach to vulnerability management. With knowledge of mapped adversary behaviors, defenders will better understand how a vulnerability can impact them, helping defenders integrate vulnerability information into their risk models and identify appropriate compensating security controls.
ATT&CK Versions: 15.1 ATT&CK Domain: Enterprise, Mobile
CVE Mapping Methodology | CISA Known Exploited Vulnerabilities Catalog
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2023-40044 | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | secondary_impact | T1202 | Indirect Command Execution |
Comments
Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.
References
|
| CVE-2023-40044 | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | primary_impact | T1071.002 | File Transfer Protocols |
Comments
Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.
References
|
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request.
References
|
| CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
This vulnerability allows viewing of restricted resources via a pre-authorization arbitrary file read vulnerability.
References
|
| CVE-2015-3043 | Adobe Flash Player Memory Corruption Vulnerability | primary_impact | T1499.004 | Application or System Exploitation |
Comments
This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system.
References
|
| CVE-2015-3043 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system.
References
|
| CVE-2023-26369 | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited through a user opening a malicious PDF file.
References
|
| CVE-2014-0546 | Adobe Acrobat and Reader Sandbox Bypass Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability allows bypassing sandbox protection and run native code.
References
|
| CVE-2010-2883 | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.
References
|
| CVE-2010-2883 | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | primary_impact | T1027 | Obfuscated Files or Information |
Comments
This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.
References
|
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution.
References
|
| CVE-2023-26359 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is utilized by exploiting a public-facing server.
References
|
| CVE-2013-0629 | Adobe ColdFusion Directory Traversal Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories
References
|
| CVE-2013-0629 | Adobe ColdFusion Directory Traversal Vulnerability | primary_impact | T1202 | Indirect Command Execution |
Comments
This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories
References
|
| CVE-2022-24086 | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | secondary_impact | T1213 | Data from Information Repositories |
Comments
This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.
References
|
| CVE-2022-24086 | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | primary_impact | T1027 | Obfuscated Files or Information |
Comments
This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.
References
|
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
References
|
| CVE-2021-21206 | Google Chromium Blink Use-After-Free Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
CVE-2021-21206 allows an adversary to use JavaScript to exploit the Blink rendering engine of the Chromium Browser that allows for execution of arbitrary code.
References
|
| CVE-2021-21206 | Google Chromium Blink Use-After-Free Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
CVE-2021-21206 allows an adversary to use JavaScript to exploit the Blink rendering engine of the Chromium Browser that allows for execution of arbitrary code.
References
|
| CVE-2021-30554 | Google Chromium WebGL Use-After-Free Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
CVE-2021-30554 allows an adversary to use JavaScript to exploit WebGL component of the Chromium browser that allows for execution of arbitrary code.
References
|
| CVE-2021-30554 | Google Chromium WebGL Use-After-Free Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
CVE-2021-30554 allows an adversary to use JavaScript to exploit WebGL component of the Chromium browser that allows for execution of arbitrary code.
References
|
| CVE-2021-37975 | Google Chromium V8 Use-After-Free Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
CVE-2021-37975 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap.
References
|
| CVE-2021-37975 | Google Chromium V8 Use-After-Free Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
CVE-2021-37975 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap.
References
|
| CVE-2021-21148 | Google Chromium V8 Heap Buffer Overflow Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
CVE-2021-21148 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap.
References
|
| CVE-2021-21148 | Google Chromium V8 Heap Buffer Overflow Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
CVE-2021-21148 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap.
References
|
| CVE-2021-21166 | Google Chromium Race Condition Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
CVE-2021-21166 allows an adversary to use JavaScript to exploit the Chromium browser via the audio object using a race condition to write into the heap.
References
|
| CVE-2021-21166 | Google Chromium Race Condition Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
CVE-2021-21166 allows an adversary to use JavaScript to exploit the Chromium browser via the audio object using a race condition to write into the heap.
References
|
| CVE-2024-38080 | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This zero-day vulnerability presents itself after an adversary has already infiltrated the victim's network and enables the adversary to obtain SYSTEM level privileges via Microsoft Windows Hyper-V product. As of now, details of how the attacker's methods to exploit this vulnerability are undisclosed.
References
|
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | primary_impact | T1136.001 | Local Account |
Comments
CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
References
|
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
References
|
| CVE-2021-29256 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available.
References
|
| CVE-2021-29256 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available.
References
|
| CVE-2024-5274 | Google Chromium V8 Type Confusion Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited by the hosting of malicious content on a website. Adversaries use this to deliver an information-stealing payload within Chrome.
References
|
| CVE-2020-0688 | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | primary_impact | T1114 | Email Collection |
Comments
CVE-2020-0688 is a remote code execution vulnerability exists in Microsoft Exchange Server. CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks. Also, Threat actors used credentials in conjunction with known vulnerabilities on public-facing applications, such as virtual private networks (VPNs)—CVE-2020-0688 and CVE-2020-17144—to escalate privileges and gain remote code execution (RCE) on the exposed applications.
References
|
| CVE-2020-0688 | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | secondary_impact | T1133 | External Remote Services |
Comments
CVE-2020-1472 is a privilege escalation vulnerability in Windows Netlogon. After gaining initial access, the actors exploit CVE-2020-1472 to compromise all Active Directory (AD) identity services. Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials.
References
|
| CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
References
|
| CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
References
|
| CVE-2021-27065 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.
References
|
| CVE-2021-27065 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.
References
|
| CVE-2021-26858 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.
References
|
| CVE-2021-26858 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.
References
|
| CVE-2021-26857 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.
References
|
| CVE-2021-26857 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1133 | External Remote Services |
Comments
CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.
References
|
| CVE-2021-26855 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.
References
|
| CVE-2021-26855 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.
References
|
| CVE-2021-26855 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1090 | Proxy |
Comments
CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.
References
|
| CVE-2021-26855 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.
References
|
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit.
References
|
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit.
References
|
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1136 | Create Account |
Comments
CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit.
References
|
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1053.005 | Scheduled Task |
Comments
CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit.
References
|
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is a remote code execution vulnerability that is often chained with CVE-2021-34523, a privilege escalation vulnerability.
References
|
| CVE-2021-34523 | Microsoft Exchange Server Privilege Escalation Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This privilege escalation vulnerability can be exploited by sending a specially crafted HTTP request to the exchange server, is it often chained together with CVE-2021-34473, a remote code execution vulnerability.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1573.001 | Symmetric Cryptography |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1560.001 | Archive via Utility |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1087.002 | Domain Account |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1070.004 | File Deletion |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1047 | Windows Management Instrumentation |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1003.003 | NTDS |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1136 | Create Account |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1218 | System Binary Proxy Execution |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1140 | Deobfuscate/Decode Files or Information |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1027 | Obfuscated Files or Information |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-40539 is an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution. Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.
References
|
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.
References
|
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | secondary_impact | T1608.001 | Upload Malware |
Comments
CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.
References
|
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.
References
|
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This remote code execution vulnerability is exploited through maliciously-crafted requests to a web application.
References
|
| CVE-2020-0688 | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.
References
|
| CVE-2020-0688 | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | primary_impact | T1110 | Brute Force |
Comments
CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | secondary_impact | T1087.002 | Domain Account |
Comments
CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | primary_impact | T1021 | Remote Services |
Comments
CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | exploitation_technique | T1110 | Brute Force |
Comments
CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.
References
|
| CVE-2020-0787 | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.
References
|
| CVE-2020-0787 | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.
References
|
| CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability | primary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts.
References
|
| CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability | primary_impact | T1608.001 | Upload Malware |
Comments
CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts.
References
|
| CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts.
References
|
| CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts.
References
|
| CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts.
References
|
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | primary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.
References
|
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | primary_impact | T1496 | Resource Hijacking |
Comments
CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.
References
|
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.
References
|
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.
References
|
| CVE-2017-11882 | Microsoft Office Memory Corruption Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems.
References
|
| CVE-2017-11882 | Microsoft Office Memory Corruption Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems.
References
|
| CVE-2020-15505 | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector that allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.
Multiple APTs have been observed exploiting this vulnerability to gain unauthorized access.
References
|
| CVE-2020-15505 | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector that allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.
Multiple APTs have been observed exploiting this vulnerability to gain unauthorized access.
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | secondary_impact | T1562.001 | Disable or Modify Tools |
Comments
CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | secondary_impact | T1070.004 | File Deletion |
Comments
CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” - CISA Advisory
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)
References
|
| CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | secondary_impact | T1083 | File and Directory Discovery |
Comments
CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials.
References
|
| CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | secondary_impact | T1552.001 | Credentials In Files |
Comments
CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials.
References
|
| CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials.
References
|
| CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials.
References
|
| CVE-2019-19781 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | secondary_impact | T1083 | File and Directory Discovery |
Comments
CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC).
References
|
| CVE-2019-19781 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC).
References
|
| CVE-2019-19781 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC).
References
|
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This is an authentication bypass vulnerability that can enable remote code execution.
Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
References
|
| CVE-2018-13379 | Fortinet FortiOS SSL VPN Path Traversal Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is a path traversal vulnerability that allows adversary to download system files through specially-crafted HTTP requests.
References
|
| CVE-2022-1388 | F5 BIG-IP Missing Authentication Vulnerability | exploitation_technique | T1548 | Abuse Elevation Control Mechanism |
Comments
This CVE is an authentication bypass vulnerability. Unauthenticated users with network access can execute arbitrary commands.
References
|
| CVE-2015-0313 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This use-after-free vulnerability is exploited in-the-wild by drive-by-download.
References
|
| CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability | primary_impact | T1565 | Data Manipulation |
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | secondary_impact | T1055.001 | Dynamic-link Library Injection |
Comments
This vulnerability has been exploited in the wild by multiple different threat actors. Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.
These adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This vulnerability has been exploited in the wild by multiple different threat actors. Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.
These adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
References
|
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1566.002 | Spearphishing Link |
Comments
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
References
|
| CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability | exploitation_technique | T1548.002 | Bypass User Account Control |
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
|
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root.
References
|
| CVE-2022-22960 | VMware Multiple Products Privilege Escalation Vulnerability | exploitation_technique | T1222 | File and Directory Permissions Modification |
Comments
This vulnerability allows adversaries with local access to escalate privileges to root. Adversaries have been observed chaining this following exploit of CVE-2022-22954.
References
|
| CVE-2024-5274 | Google Chromium V8 Type Confusion Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by the hosting of malicious content on a website. Adversaries use this to deliver an information-stealing payload within Chrome.
References
|
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | exploitation_technique | T1221 | Template Injection |
Comments
This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root.
References
|
| CVE-2012-0767 | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | secondary_impact | T1114.002 | Remote Email Collection |
Comments
This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website. The attacker
can then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail.
References
|
| CVE-2012-0767 | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | secondary_impact | T1098 | Account Manipulation |
Comments
This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website. The attacker
can then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail.
References
|
| CVE-2012-0767 | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | primary_impact | T1185 | Browser Session Hijacking |
Comments
This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website. The attacker
can then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail.
References
|
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1046 | Network Service Discovery |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1003.001 | LSASS Memory |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1036.005 | Match Legitimate Name or Location |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1484.001 | Group Policy Modification |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1059.007 | JavaScript |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2016-4437 | Apache Shiro Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2016-4437 is a code execution vulnerability in Apache Shiro that allows remote attackers to execute code or bypass access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
References
|
| CVE-2016-4437 | Apache Shiro Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2016-4437 is a code execution vulnerability in Apache Shiro that allows remote attackers to execute code or bypass access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
References
|
| CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability | exploitation_technique | T1210 | Exploitation of Remote Services |
Comments
CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.
References
|
| CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.
References
|
| CVE-2021-41773 | Apache HTTP Server Path Traversal Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.
References
|
| CVE-2021-41773 | Apache HTTP Server Path Traversal Vulnerability | exploitation_technique | T1210 | Exploitation of Remote Services |
Comments
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.
References
|
| CVE-2020-0069 | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-0069 is an insufficient input validation vulnerability in multiple MediaTek chipsets that, combined with missing SELinux restrictions in the Command Queue drivers' ioctl handlers, allows an adversary to perform an out-of-bounds write leading to privilege escalation.
References
|
| CVE-2020-5735 | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | primary_impact | T1574 | Hijack Execution Flow |
Comments
CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device.
References
|
| CVE-2020-5735 | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | secondary_impact | T1499 | Endpoint Denial of Service |
Comments
CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device.
References
|
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | secondary_impact | T1007 | System Service Discovery |
Comments
CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices.
References
|
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | primary_impact | T1082 | System Information Discovery |
Comments
CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices.
References
|
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices.
References
|
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability gives an adversary access through exploitation of a public-facing server.
References
|
| CVE-2013-0625 | Adobe ColdFusion Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited because of password misconfiguration.
References
|
| CVE-2013-0632 | Adobe ColdFusion Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by logging in with an empty password on a misconfigured system.
References
|
| CVE-2009-3960 | Adobe BlazeDS Information Disclosure Vulnerability | primary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited through an XML injection or XML external entity injection. In-the-wild reporting indicates adversaries have used this exploit to establish a web shell on a victim machine.
This adversary took actions to cover their tracks, establish persistence, exfiltrate Registry data, escalated privileges, moved laterally, disabled security software, installed and ran ransomware.
References
|
| CVE-2009-3960 | Adobe BlazeDS Information Disclosure Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an XML injection or XML external entity injection. In-the-wild reporting indicates adversaries have used this exploit to establish a web shell on a victim machine.
This adversary took actions to cover their tracks, establish persistence, exfiltrate Registry data, escalated privileges, moved laterally, disabled security software, installed and ran ransomware.
References
|
| CVE-2012-0767 | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website. The attacker
can then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail.
References
|
| CVE-2016-1019 | Adobe Flash Player Arbitrary Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit. After exploit, adversaries can install their own malware or specifically ransomware.
References
|
| CVE-2016-1019 | Adobe Flash Player Arbitrary Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit. After exploit, adversaries can install their own malware or specifically ransomware.
References
|
| CVE-2016-1019 | Adobe Flash Player Arbitrary Code Execution Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit. After exploit, adversaries can install their own malware or specifically ransomware.
References
|
| CVE-2021-29256 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available.
References
|
| CVE-2024-38080 | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This zero-day vulnerability presents itself after an adversary has already infiltrated the victim's network and enables the adversary to obtain SYSTEM level privileges via Microsoft Windows Hyper-V product. As of now, details of how the attacker's methods to exploit this vulnerability are undisclosed.
References
|
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
References
|
| CVE-2018-11776 | Apache Struts Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. Volexity also reports active scanning and attempts to exploit CVE-2018-11776 in order to deploy cryptocurrency miners.
References
|
| CVE-2018-11776 | Apache Struts Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace.
References
|
| CVE-2018-11776 | Apache Struts Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace.
References
|
| CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2017-5638 is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach.
References
|
| CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2017-5638 is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach.
References
|
| CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2017-5638 is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach.
References
|
| CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-17530 is a remote code execution vulnerability in Apache Struts versions 2.0.0 - 2.5.25 allows an attacker to execute code via forced Object Graph Navigational Language (OGNL).
References
|
| CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2020-17530 is a remote code execution vulnerability in Apache Struts versions 2.0.0 - 2.5.25 allows an attacker to execute arbitrary code via forced Object Graph Navigational Language (OGNL) evaluation on raw user input in tag attributes.
References
|
| CVE-2019-17558 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2019-17558 is a vulnerability in Apache Solr that allows for Remote Code Execution (RCE) through the VelocityResponseWriter.
References
|
| CVE-2019-17558 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2019-17558 is a vulnerability in Apache Solr that allows for Remote Code Execution (RCE) through the VelocityResponseWriter.
References
|
| CVE-2019-0211 | Apache HTTP Server Privilege Escalation Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server with MPM event, worker, or prefork that allows an attacker to execute code with the privileges of that parent process (usually root).
References
|
| CVE-2017-9805 | Apache Struts Deserialization of Untrusted Data Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application.
References
|
| CVE-2017-9805 | Apache Struts Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application.
References
|
| CVE-2021-27104 | Accellion FTA OS Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint.
References
|
| CVE-2021-27104 | Accellion FTA OS Command Injection Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint.
References
|
| CVE-2021-27101 | Accellion FTA SQL Injection Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2021-27101 is a SQL injection vulnerability in Accellion File Transfer Appliance that allows an adversary to execute SQL commands.
References
|
| CVE-2021-27103 | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2021-27103 is a server-side request forgery vulnerability in Accellion File Transfer Appliance in Accellion that allows an adversary to manipulate server requests via a crafted POST request.
References
|
| CVE-2021-27102 | Accellion FTA OS Command Injection Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call.
References
|
| CVE-2021-27102 | Accellion FTA OS Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call.
References
|
| CVE-2021-27103 | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-27103 is a server-side request forgery vulnerability in Accellion File Transfer Appliance in Accellion that allows an adversary to manipulate server requests via a crafted POST request.
References
|
| CVE-2021-27102 | Accellion FTA OS Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call.
References
|
| CVE-2021-27101 | Accellion FTA SQL Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-27101 is a SQL injection vulnerability in Accellion File Transfer Appliance that allows an adversary to execute SQL commands.
References
|
| CVE-2021-27104 | Accellion FTA OS Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint.
References
|
| CVE-2018-4990 | Adobe Acrobat and Reader Double Free Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
This vulnerability is exploited via embedded javascript within a user-executed malicious pdf. There are two mapped exploitation_technqiues for this CVE.
References
|
| CVE-2018-4990 | Adobe Acrobat and Reader Double Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via embedded javascript within a user-executed malicious pdf. There are two mapped exploitation_technqiues for this CVE.
References
|
| CVE-2007-5659 | Adobe Acrobat and Reader Buffer Overflow Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via a malicious PDF file in order to execute arbitrary code.
References
|
| CVE-2018-4878 | Adobe Flash Player Use-After-Free Vulnerability | secondary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration.
References
|
| CVE-2018-4878 | Adobe Flash Player Use-After-Free Vulnerability | primary_impact | T1219 | Remote Access Software |
Comments
The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration.
Installation of the remote access software could allow for a number of different secondary impacts. See the MITRE ATT&CK reference on the DOGCALL software for more information.
References
|
| CVE-2018-4878 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration.
References
|
| CVE-2018-15961 | Adobe ColdFusion Unrestricted File Upload Vulnerability | primary_impact | T1491.002 | External Defacement |
Comments
In the wild, this CVE was seen to result in defacement.
References
|
| CVE-2018-15961 | Adobe ColdFusion Unrestricted File Upload Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by uploading a file to a public-facing ColdFusion server.
References
|
| CVE-2018-4939 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1190 | Exploit Public-Facing Application |
Comments
As referenced in the attached report, T1190 is a known impact of this exploit.
References
|
| CVE-2018-4939 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1133 | External Remote Services |
Comments
As referenced in the attached report, T1133 is a known impact of this exploit.
References
|
| CVE-2018-4939 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This deserialization vulnerability allows adversaries to insert their own objects into client software for potential execution.
References
|
| CVE-2021-28550 | Adobe Acrobat and Reader Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts.
References
|
| CVE-2021-21017 | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts.
References
|
| CVE-2021-33739 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | exploitation_technique | T1598.002 | Spearphishing Attachment |
Comments
Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment.
References
|
| CVE-2021-33739 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment.
References
|
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | primary_impact | T1498 | Network Denial of Service |
Comments
CVE-2021-22205 is a Remote Code Execution Vulnerability on GitLab Community and Enterprise Editions where threat actors have been reported to actively exploit the security flaw to co-opt unpatched GitLab servers into a botnet and launch distributed denial of service (DDoS) attacks
References
|
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks.
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | secondary_impact | T1046 | Network Service Discovery |
Comments
CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows
References
|
| CVE-2019-13608 | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows
References
|
| CVE-2019-13608 | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware
References
|
| CVE-2019-13608 | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | secondary_impact | T1046 | Network Service Discovery |
Comments
CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
References
|
| CVE-2019-13608 | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
References
|
| CVE-2019-13608 | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
References
|
| CVE-2018-0296 | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | exploitation_technique | T1202 | Indirect Command Execution |
Comments
CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information.
References
|
| CVE-2018-0296 | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information.
References
|
| CVE-2021-1498 | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2021-1498 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device
References
|
| CVE-2021-1498 | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-1498 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device
References
|
| CVE-2021-1497 | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2021-1497 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Installer Virtual Machine. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device
References
|
| CVE-2021-1497 | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-1497 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Installer Virtual Machine. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device
References
|
| CVE-2016-4117 | Adobe Flash Player Arbitrary Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation.
References
|
| CVE-2016-4117 | Adobe Flash Player Arbitrary Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation.
References
|
| CVE-2016-0984 | Adobe Flash Player and AIR Use-After-Free Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.
This CVE was observed to be exploited by the threat actor known as BlackOasis. The threat actor then installs command and control tools.
References
|
| CVE-2016-0984 | Adobe Flash Player and AIR Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.
This CVE was observed to be exploited by the threat actor known as BlackOasis.
References
|
| CVE-2016-1010 | Adobe Flash Player and AIR Integer Overflow Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This vulnerability is exploited via an integer overflow.
References
|
| CVE-2024-34102 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data.
References
|
| CVE-2024-34102 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data.
References
|
| CVE-2024-34102 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data.
References
|
| CVE-2022-24086 | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.
References
|
| CVE-2013-0631 | Adobe ColdFusion Information Disclosure Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited via a public-facing application. The adversary can use this vulnerability to gain access to victim host information.
References
|
| CVE-2013-0631 | Adobe ColdFusion Information Disclosure Vulnerability | primary_impact | T1592 | Gather Victim Host Information |
Comments
This vulnerability is exploited via a public-facing application. The adversary can use this vulnerability to gain access to victim host information.
References
|
| CVE-2023-38205 | Adobe ColdFusion Improper Access Control Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2023-38205 is a vulnerability that is the result of an incomplete patch of CVE-2023-29298. An adversary remains able to exploit the public-facing application as a result of this vulnerability.
References
|
| CVE-2023-29298 | Adobe ColdFusion Improper Access Control Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is used by exploited a public-facing application by exploiting a flaw in URL path validation.
References
|
| CVE-2020-3580 | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | secondary_impact | T1217 | Browser Information Discovery |
Comments
CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface
or access sensitive browser-based information.
References
|
| CVE-2020-3580 | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface
or access sensitive browser-based information.
References
|
| CVE-2020-3580 | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface
or access sensitive browser-based information.
References
|
| CVE-2020-3452 | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
CVE-2020-3452 is a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.
References
|
| CVE-2020-3452 | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | exploitation_technique | T1202 | Indirect Command Execution |
Comments
CVE-2020-3452 is a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.
References
|
| CVE-2021-42258 | BQE BillQuick Web Suite SQL Injection Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2021-42258 is a SQL injection vulnerability in BillQuick Web Suite that allows attackers to execute arbitrary SQL commands on the database server
References
|
| CVE-2021-42258 | BQE BillQuick Web Suite SQL Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-42258 is a SQL injection vulnerability in BillQuick Web Suite that allows attackers to execute arbitrary SQL commands on the database server
References
|
| CVE-2019-3396 | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | secondary_impact | T1202 | Indirect Command Execution |
Comments
CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution.
References
|
| CVE-2019-3396 | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | primary_impact | T1090 | Proxy |
Comments
CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution.
References
|
| CVE-2019-3396 | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution.
References
|
| CVE-2019-11580 | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2019-11580 is a critical vulnerability affecting Atlassian Crowd and Crowd Data Center that allows attackers remote code execution to send specially crafted requests to install malicious plugins on vulnerable Crowd instances.
References
|
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances
References
|
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances
References
|
| CVE-2019-3398 | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center that allows an authenticated attacker to write files to arbitrary locations, potentially leading to remote code execution
References
|
| CVE-2019-3398 | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | exploitation_technique | T1202 | Indirect Command Execution |
Comments
CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center that allows an authenticated attacker to write files to arbitrary locations, potentially leading to remote code execution
References
|
| CVE-2010-2861 | Adobe ColdFusion Directory Traversal Vulnerability | secondary_impact | T1119 | Automated Collection |
Comments
This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.
References
|
| CVE-2010-2861 | Adobe ColdFusion Directory Traversal Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.
References
|
| CVE-2010-2861 | Adobe ColdFusion Directory Traversal Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.
References
|
| CVE-2013-0629 | Adobe ColdFusion Directory Traversal Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories.
References
|
| CVE-2023-38203 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.
References
|
| CVE-2023-38203 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.
References
|
| CVE-2023-29300 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.
References
|
| CVE-2023-29300 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.
References
|
| CVE-2023-26359 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is utilized by exploiting a public-facing server.
References
|
| CVE-2009-1862 | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited through a user opening a maliciously-crafted pdf file or swf file.
References
|
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution.
References
|
| CVE-2009-4324 | Adobe Acrobat and Reader Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications.
References
|
| CVE-2009-4324 | Adobe Acrobat and Reader Use-After-Free Vulnerability | primary_impact | T1071.001 | Web Protocols |
Comments
This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications.
References
|
| CVE-2008-0655 | Adobe Acrobat and Reader Unspecified Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having a user open a maliciously-crafted pdf file.
References
|
| CVE-2009-3953 | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having a user open a maliciously-crafted pdf file.
References
|
| CVE-2011-2462 | Adobe Acrobat and Reader Universal 3D Memory Corruption Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having the user open a malicious pdf file to achieve arbitrary code execution.
References
|
| CVE-2010-2883 | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.
References
|
| CVE-2014-0546 | Adobe Acrobat and Reader Sandbox Bypass Vulnerability | primary_impact | T1497 | Virtualization/Sandbox Evasion |
Comments
This vulnerability allows bypassing sandbox protection and run native code.
References
|
| CVE-2023-26369 | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited through a user opening a malicious PDF file.
References
|
| CVE-2022-26134 | Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by placing a payload in the URI of an HTTP request to a public-facing server.
References
|
| CVE-2022-30190 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines.
References
|
| CVE-2022-30190 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines.
References
|
| CVE-2008-2992 | Adobe Reader and Acrobat Input Validation Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via a maliciously-crafted pdf file.
References
|
| CVE-2010-0188 | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited via drive-by download. Malicious software is this downloaded on the target machine.
References
|
| CVE-2010-0188 | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited via drive-by download. Malicious software is this downloaded on the target machine.
References
|
| CVE-2013-0640 | Adobe Reader and Acrobat Memory Corruption Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
This vulnerability is exploited via a maliciously-crafted pdf delivered as an email attachment.
References
|
| CVE-2013-0641 | Adobe Reader Buffer Overflow Vulnerability | secondary_impact | T1048 | Exfiltration Over Alternative Protocol |
Comments
This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration.
References
|
| CVE-2013-0641 | Adobe Reader Buffer Overflow Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration.
References
|
| CVE-2013-0641 | Adobe Reader Buffer Overflow Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration.
References
|
| CVE-2013-3346 | Adobe Reader and Acrobat Memory Corruption Vulnerability | exploitation_technique | T1059.007 | JavaScript |
Comments
This vulnerability is exploited via maliciously-crafted javascript.
References
|
| CVE-2014-0496 | Adobe Reader and Acrobat Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via a maliciously-crafted file.
References
|
| CVE-2016-7855 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by having users visit a maliciously website.
References
|
| CVE-2017-11292 | Adobe Flash Player Type Confusion Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.
References
|
| CVE-2017-11292 | Adobe Flash Player Type Confusion Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.
References
|
| CVE-2017-11292 | Adobe Flash Player Type Confusion Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.
References
|
| CVE-2017-11292 | Adobe Flash Player Type Confusion Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.
References
|
| CVE-2018-15982 | Adobe Flash Player Use-After-Free Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited via a maliciously-crafted Word document, which then extracts the adversary's RAT tool.
References
|
| CVE-2018-15982 | Adobe Flash Player Use-After-Free Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via a maliciously-crafted Word document, which then extracts the adversary's RAT tool.
References
|
| CVE-2010-1297 | Adobe Flash Player Memory Corruption Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.
This vulnerability is also exploited via user execution of a maliciously crafted pdf file.
In the wild, threat actors have used this to download malicious software onto the target system.
References
|
| CVE-2010-1297 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.
This vulnerability is also exploited via user execution of a maliciously crafted pdf file.
In the wild, threat actors have used this to download malicious software onto the target system.
References
|
| CVE-2010-1297 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.
This vulnerability is also exploited via user execution of a maliciously crafted pdf file.
In the wild, threat actors have used this to download malicious software onto the target system.
References
|
| CVE-2012-5054 | Adobe Flash Player Integer Overflow Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability can be exploited by a malicioiusly-crafted webpage via drive-by compromise.
References
|
| CVE-2014-8439 | Adobe Flash Player Dereferenced Pointer Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a webpage via drive-by compromise.
References
|
| CVE-2015-8651 | Adobe Flash Player Integer Overflow Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine.
References
|
| CVE-2015-8651 | Adobe Flash Player Integer Overflow Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine.
References
|
| CVE-2015-8651 | Adobe Flash Player Integer Overflow Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine.
References
|
| CVE-2015-0310 | Adobe Flash Player ASLR Bypass Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits.
References
|
| CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | secondary_impact | T1622 | Debugger Evasion |
Comments
This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file.
In the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system. The command and control functionality has also been seen to employ debugging/sandboxing evasion.
References
|
| CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | secondary_impact | T1497 | Virtualization/Sandbox Evasion |
Comments
This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file.
In the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system. The command and control functionality has also been seen to employ debugging/sandboxing evasion.
References
|
| CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | primary_impact | T1071.001 | Web Protocols |
Comments
This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file.
In the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system. The command and control functionality has also been seen to employ debugging/sandboxing evasion.
References
|
| CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file.
In the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system. The command and control functionality has also been seen to employ debugging/sandboxing evasion.
References
|
| CVE-2012-2034 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by a maliciously-crafted .swf via drive-by compromise.
References
|
| CVE-2011-0611 | Adobe Flash Player Remote Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by having a user execute a maliciously-crafted word document or pdf file that has embedded swf. The malicious code then downloads another payload to the target machine.
References
|
| CVE-2011-0611 | Adobe Flash Player Remote Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having a user execute a maliciously-crafted word document or pdf file that has embedded swf. The malicious code then downloads another payload to the target machine.
References
|
| CVE-2012-1535 | Adobe Flash Player Arbitrary Code Execution Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by having a user execute a maliciously-crafted word document that has embedded swf. The embedded swf can download additional malicious software from the web.
References
|
| CVE-2012-1535 | Adobe Flash Player Arbitrary Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by having a user execute a maliciously-crafted word document that has embedded swf. The embedded swf can download additional malicious software from the web.
References
|
| CVE-2015-3043 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system via drive-by compromise.
References
|
| CVE-2015-7645 | Adobe Flash Player Arbitrary Code Execution Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited by the user opening a maliciously-crafted .swf file.
References
|
| CVE-2020-12812 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | primary_impact | T1556 | Modify Authentication Process |
Comments
CVE-2020-12812 is an improper authentication vulnerability in Fortinet's FortiOS, specifically affecting the SSL VPN feature. This vulnerability allows attackers to bypass two-factor authentication under certain conditions, potentially leading to unauthorized access to sensitive systems.
References
|
| CVE-2020-12812 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | exploitation_technique | T1556 | Modify Authentication Process |
Comments
CVE-2020-12812 is an improper authentication vulnerability in Fortinet's FortiOS, specifically affecting the SSL VPN feature. This vulnerability allows attackers to bypass two-factor authentication under certain conditions, potentially leading to unauthorized access to sensitive systems.
References
|
| CVE-2019-5591 | Fortinet FortiOS Default Configuration Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.
References
|
| CVE-2019-5591 | Fortinet FortiOS Default Configuration Vulnerability | primary_impact | T1557 | Adversary-in-the-Middle |
Comments
CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.
References
|
| CVE-2019-5591 | Fortinet FortiOS Default Configuration Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.
References
|
| CVE-2021-35464 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-35464, a pre-auth remote code execution (RCE) vulnerability in ForgeRock Access Manager identity and access management software. ForgeRock front-ends web applications and remote access solutions in many enterprises.
References
|
| CVE-2021-35464 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-35464, a pre-auth remote code execution (RCE) vulnerability in ForgeRock Access Manager identity and access management software. ForgeRock front-ends web applications and remote access solutions in many enterprises.
References
|
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | secondary_impact | T1485 | Data Destruction |
Comments
CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory "This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. "
References
|
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory "This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. "
References
|
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory "This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. "
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | secondary_impact | T1552 | Unsecured Credentials |
Comments
CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” - CISA Advisory
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” - CISA Advisory
References
|
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” - CISA Advisory
References
|
| CVE-2020-8657 | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability | exploitation_technique | T1106 | Native API |
Comments
CVE-2020-8657 identifies a security issue in EyesOfNetwork 5.3 that exposes a vulnerability in the API key implementation.
References
|
| CVE-2018-6789 | Exim Buffer Overflow Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2018-6789 is a vulnerability in Exim, an open-source mail transfer agent. This vulnerability, identified as an off-by-one buffer overflow, allows attackers to execute arbitrary code remotely by sending specially crafted messages to the SMTP listener.
References
|
| CVE-2018-6789 | Exim Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2018-6789 is a vulnerability in Exim, an open-source mail transfer agent. This vulnerability, identified as an off-by-one buffer overflow, allows attackers to execute arbitrary code remotely by sending specially crafted messages to the SMTP listener.
References
|
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | secondary_impact | T1498 | Network Denial of Service |
Comments
CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks.
References
|
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks.
References
|
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks.
References
|
| CVE-2018-7600 | Drupal Core Remote Code Execution Vulnerability | secondary_impact | T1485 | Data Destruction |
Comments
CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.
References
|
| CVE-2018-7600 | Drupal Core Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.
References
|
| CVE-2018-7600 | Drupal Core Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.
References
|
| CVE-2018-7600 | Drupal Core Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.
References
|
| CVE-2020-8515 | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.
References
|
| CVE-2020-8515 | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.
References
|
| CVE-2020-8515 | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.
References
|
| CVE-2017-9822 | DotNetNuke (DNN) Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications
References
|
| CVE-2017-9822 | DotNetNuke (DNN) Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications
References
|
| CVE-2017-9822 | DotNetNuke (DNN) Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications
References
|
| CVE-2020-25506 | D-Link DNS-320 Device Command Injection Vulnerability | secondary_impact | T1584.005 | Botnet |
Comments
CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.
References
|
| CVE-2020-25506 | D-Link DNS-320 Device Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.
References
|
| CVE-2020-25506 | D-Link DNS-320 Device Command Injection Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.
References
|
| CVE-2020-29557 | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | secondary_impact | T1584.005 | Botnet |
Comments
CVE-2020-29557 is a buffer overflow vulnerability in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure.
References
|
| CVE-2020-29557 | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2020-29557 is a buffer overflow vulnerability in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure.
References
|
| CVE-2020-29557 | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2020-29557 is a buffer overflow vulnerability in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure.
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware
References
|
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware
References
|
| CVE-2020-8193 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | exploitation_technique | T1556 | Modify Authentication Process |
Comments
CVE-2020-8193 is an Authorization Bypass vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP Appliance in various versions allows attacker to bypass authentication mechanisms via crafted requests.
References
|
| CVE-2020-8193 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
CVE-2020-8193 is an Authorization Bypass vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP Appliance in various versions allows attacker to bypass authentication mechanisms via crafted requests.
References
|
| CVE-2020-8195 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | exploitation_technique | T1056 | Input Capture |
Comments
CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2020-8195 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | primary_impact | T1082 | System Information Discovery |
Comments
CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2020-8195 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2020-8196 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | exploitation_technique | T1056 | Input Capture |
Comments
CVE-2020-8196
is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2020-8196 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | primary_impact | T1082 | System Information Discovery |
Comments
CVE-2020-8196
is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2020-8196 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2020-8196
is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests.
References
|
| CVE-2024-26169 | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
References
|
| CVE-2024-26169 | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | exploitation_technique | T1112 | Modify Registry |
Comments
This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
References
|
| CVE-2024-38112 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system.
References
|
| CVE-2024-38112 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system.
References
|
| CVE-2021-3129 | Laravel Ignition File Upload Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code.
References
|
| CVE-2021-3129 | Laravel Ignition File Upload Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code.
References
|
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | primary_impact | T1195.002 | Compromise Software Supply Chain |
Comments
This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the "csrf-magic", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's "nobody" user account.
References
|
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the "csrf-magic", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's "nobody" user account.
References
|
| CVE-2021-40655 | D-Link DIR-605 Router Information Disclosure Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited when an adversary forges a post request to the / get cfg.php page. The POST request could enable the adversary to obtain username and password information on the router.
References
|
| CVE-2021-36380 | Sunhillo SureLine OS Command Injection Vulnerablity | primary_impact | T1059.004 | Unix Shell |
Comments
To trigger this vulnerability, an attacker sends a specially crafted POST request to the webserver at the URL /cgi/networkDiag.cgi . Within this request, the attacker inserts a Linux command as part of the ipAddr or dnsAddr POST parameters. When the webserver processes the POST request, the command the attacker has inserted into the parameter will be executed.
References
|
| CVE-2021-36380 | Sunhillo SureLine OS Command Injection Vulnerablity | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
To trigger this vulnerability, an attacker sends a specially crafted POST request to the webserver at the URL /cgi/networkDiag.cgi . Within this request, the attacker inserts a Linux command as part of the ipAddr or dnsAddr POST parameters. When the webserver processes the POST request, the command the attacker has inserted into the parameter will be executed.
References
|
| CVE-2024-26169 | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
References
|
| CVE-2024-30051 | Microsoft DWM Core Library Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is a zero-day exploit that is believed to still be utilized by various adversarial groups leading to limited publicly available exploitation information. The vulnerability is a "heap-based protector flood susceptibility impacting the Windows DWM Core Library" enabling an adversary to gain SYSTEM privileges.
References
|
| CVE-2023-29492 | Novi Survey Insecure Deserialization Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2023-29492 is an insecure deserialization vulnerability. Exploitation of this vulnerability gives remote attackers arbitrary code execution in the context of the service account.
References
|
| CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability allows viewing of restricted resources via a pre-authorization arbitrary file read vulnerability.
References
|
| CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | exploitation_technique | T1552.001 | Credentials In Files |
Comments
CVE-2022-26138 is a hard-coded credentials vulnerability in the "Questions for Confluence" app.
References
|
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request.
References
|
| CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection Vulnerability | primary_impact | T1496 | Resource Hijacking |
Comments
CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes.
References
|
| CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection Vulnerability | exploitation_technique | T1221 | Template Injection |
Comments
CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes.
References
|
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,
References
|
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | primary_impact | T1033 | System Owner/User Discovery |
Comments
CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,
References
|
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery and downloading malicious payloads.
References
|
| CVE-2021-27059 | Microsoft Office Remote Code Execution Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
The vulnerability allows a remote user to execute arbitrary code on the target system due to improper input validation in Microsoft Office.
References
|
| CVE-2023-21715 | Microsoft Office Publisher Security Feature Bypass Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
CVE-2023-21715 is a security feature bypass vulnerability exploitable when a user opens a specially-crafted file bypassing macro policies.
References
|
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.
References
|
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability | primary_impact | T1550.002 | Pass the Hash |
Comments
This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.
References
|
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.
References
|
| CVE-2023-27350 | PaperCut MF/NG Improper Access Control Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.
References
|
| CVE-2023-27350 | PaperCut MF/NG Improper Access Control Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.
References
|
| CVE-2023-27350 | PaperCut MF/NG Improper Access Control Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.
References
|
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability allows a few REST-API URLs without authentication.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1573.001 | Symmetric Cryptography |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1560.001 | Archive via Utility |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1087.002 | Domain Account |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1070.004 | File Deletion |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1047 | Windows Management Instrumentation |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1003.003 | NTDS |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1136 | Create Account |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1218 | System Binary Proxy Execution |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1140 | Deobfuscate/Decode Files or Information |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | secondary_impact | T1027 | Obfuscated Files or Information |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
References
|
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating
domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.
References
|
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | secondary_impact | T1069 | Permission Groups Discovery |
Comments
CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating
domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.
References
|
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | secondary_impact | T1087 | Account Discovery |
Comments
CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating
domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.
References
|
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating
domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.
References
|
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating
domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.
References
|
| CVE-2022-28810 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2022-28810 is a vulnerability that exists when custom password sync scripts are enabled when an adversary passes commands in the password field that can lead to remote code execution.
References
|
| CVE-2022-35405 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
CVE-2022-35405 is an unauthenticated remote code execution vulnerability as a result of deserialization.
References
|
| CVE-2024-4358 | Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2024-4358 is an authentication bypass vulnerability. This has been seen to be chained with CVE-2024-1800 in order to achieve remote code execution.
References
|
| CVE-2023-40044 | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | secondary_impact | T1531 | Account Access Removal |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | secondary_impact | T1136 | Create Account |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | secondary_impact | T1082 | System Information Discovery |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.
References
|
| CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download | primary_impact | T1601 | Modify System Image |
Comments
CVE-2021-44168 is an unverified update download vulnerability that can be exploited by adversaries with local access creating specifically crafted download packages.
References
|
| CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download | exploitation_technique | T1078.003 | Local Accounts |
Comments
CVE-2021-44168 is an unverified update download vulnerability that can be exploited by adversaries with local access creating specifically crafted download packages.
References
|
| CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability | primary_impact | T1098.004 | SSH Authorized Keys |
Comments
This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method.
References
|
| CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method.
References
|
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability | secondary_impact | T1049 | System Network Connections Discovery |
Comments
CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
References
|
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability | secondary_impact | T1565.001 | Stored Data Manipulation |
Comments
CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
References
|
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability | primary_impact | T1037 | Boot or Logon Initialization Scripts |
Comments
CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
References
|
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
References
|
| CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.
This malicious software has observed anti-debugging and command and control capabilities (over HTTP).
References
|
| CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | secondary_impact | T1622 | Debugger Evasion |
Comments
CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.
This malicious software has observed anti-debugging and command and control capabilities (over HTTP).
References
|
| CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | primary_impact | T1574 | Hijack Execution Flow |
Comments
CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.
This malicious software has observed anti-debugging and command and control capabilities (over HTTP).
References
|
| CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.
This malicious software has observed anti-debugging and command and control capabilities (over HTTP).
References
|
| CVE-2023-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.
References
|
| CVE-2023-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.
References
|
| CVE-2023-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.
References
|
| CVE-2024-21762 | Fortinet FortiOS Out-of-Bound Write Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write.
References
|
| CVE-2024-21762 | Fortinet FortiOS Out-of-Bound Write Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write.
References
|
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | primary_impact | T1136 | Create Account |
Comments
This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.
Adversaries have been observed adding accounts to config files
References
|
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.
Adversaries have been observed adding accounts to config files
References
|
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.
Adversaries have been observed adding accounts to config files
References
|
| CVE-2023-6548 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | exploitation_technique | T1055 | Process Injection |
Comments
This vulnerability allows for authenticated (low-privilege) remote code execution via code injection.
References
|
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | secondary_impact | T1087.002 | Domain Account |
Comments
This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow. Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.
References
|
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow. Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.
References
|
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow. Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.
References
|
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow. Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.
References
|
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | primary_impact | T1499 | Endpoint Denial of Service |
Comments
This buffer overflow vulnerability can be exploited to cause a denial of service.
References
|
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This buffer overflow vulnerability can be exploited to cause a denial of service.
References
|
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | secondary_impact | T1134.001 | Token Impersonation/Theft |
Comments
This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.
References
|
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.
References
|
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.
References
|
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | secondary_impact | T1542.005 | TFTP Boot |
Comments
CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.
References
|
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.
References
|
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | exploitation_technique | T1574 | Hijack Execution Flow |
Comments
CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.
References
|
| CVE-2021-4034 | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
The Polkit/Pwnkit vulnerability (CVE-2021-4034) is a critical vulnerability impacting every major Linux distribution. Its attack vector allows privilege escalation and can even give the attacker root access.
References
|
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | primary_impact | T1090 | Proxy |
Comments
The iControl REST interface has an unauthenticated remote command execution vulnerability. This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services.
References
|
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2021-27860 is a vulnerability in the web management interface in FatPipe software. The vulnerability allowed APT actors to gain access to an unrestricted file upload function to drop a webshell for exploitation activity with root access, leading to elevated privileges and potential follow-on activity. Exploitation of this vulnerability then served as a jumping off point into other infrastructure for the APT actors.
References
|
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | secondary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions.
References
|
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions.
References
|
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions.
References
|
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | secondary_impact | T1048 | Exfiltration Over Alternative Protocol |
Comments
CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.
References
|
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
The iControl REST interface has an unauthenticated remote command execution vulnerability. This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services.
References
|
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2021-27860 is a vulnerability in the web management interface in FatPipe software. The vulnerability allowed APT actors to gain access to an unrestricted file upload function to drop a webshell for exploitation activity with root access, leading to elevated privileges and potential follow-on activity. Exploitation of this vulnerability then served as a jumping off point into other infrastructure for the APT actors.
References
|
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions.
References
|
| CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE 2021-45046 is a Log4J-related vulnerability that has been seen to be used in cryptomining and ransomware operations.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | primary_impact | T1087.002 | Domain Account |
Comments
CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. CVE-2020-1472 has been reported to be exploited by Ransomware groups for initial access.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access.
References
|
| CVE-2019-0708 | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | secondary_impact | T1498 | Network Denial of Service |
Comments
CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.
References
|
| CVE-2019-0708 | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.
References
|
| CVE-2021-42237 | Sitecore XP Remote Command Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE 2021-42237related to a remote code execution vulnerability through insecure deserialization.
References
|
| CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE 2021-45046 is a Log4J-related vulnerability that could enable enables an attacker to cause Remote Code Execution or other effects in certain non-default configurations. This specific vulnerability has been reported to have been leveraged in cryptomining and ransomware operations.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access.
References
|
| CVE-2019-0708 | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.
References
|
| CVE-2024-20399 | Cisco NX-OS Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges.
References
|
| CVE-2024-20399 | Cisco NX-OS Command Injection Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges.
References
|
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | primary_impact | T1499 | Endpoint Denial of Service |
Comments
This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups.
References
|
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups.
References
|
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups.
References
|
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | primary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an unauthenticated, remote attacker by specifying a default connection profile/tunnel group, enabling a brute-force attack to identify valid credentials and establish a clienteles SSL VPN session using those valid credentials.
References
|
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
This vulnerability is exploited by an unauthenticated, remote attacker by specifying a default connection profile/tunnel group, enabling a brute-force attack to identify valid credentials and establish a clienteles SSL VPN session using those valid credentials.
References
|
| CVE-2024-20359 | Cisco ASA and FTD Privilege Escalation Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an authenticated, local attacker in order to execute arbitrary code with root-level privileges by copying a crafted file to the disk0: file system. This is possible due to improper validation of a file when it is read from system flash memory. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
References
|
| CVE-2024-20359 | Cisco ASA and FTD Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an authenticated, local attacker in order to execute arbitrary code with root-level privileges by copying a crafted file to the disk0: file system. This is possible due to improper validation of a file when it is read from system flash memory. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
References
|
| CVE-2024-20353 | Cisco ASA and FTD Denial of Service Vulnerability | secondary_impact | T1608.001 | Upload Malware |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
References
|
| CVE-2024-20353 | Cisco ASA and FTD Denial of Service Vulnerability | primary_impact | T1653 | Power Settings |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
References
|
| CVE-2024-20353 | Cisco ASA and FTD Denial of Service Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. In early 2024, the Cisco Product Security Incident Response Team (PSIRT) identified an attack campaign named ArcaneDoor, which targeted these vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
References
|
| CVE-2022-20699 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker by "sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.” This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker.
References
|
| CVE-2022-20699 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker by "sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.” This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker.
References
|
| CVE-2022-20700 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
This vulnerability is exploited by a remote attacker who sends specific commands to a Cisco router that does not have sufficient authorization enforcement mechanisms in place. This could allow the remote attacker to gain root privileges and execute arbitrary commands on the system.
References
|
| CVE-2022-20700 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker who sends specific commands to a Cisco router that does not have sufficient authorization enforcement mechanisms in place. This could allow the remote attacker to gain root privileges and execute arbitrary commands on the system.
References
|
| CVE-2022-20701 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This insufficient authorization vulnerability is exploited by a local attacker who has access to low-privileged code where they then execute commands within confd_cli at a higher privilege levels. Performing these commands could grant the local attacker root privileges.
References
|
| CVE-2022-20701 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This insufficient authorization vulnerability is exploited by a local attacker who has access to low-privileged code where they then execute commands within confd_cli at a higher privilege levels. Performing these commands could grant the local attacker root privileges.
References
|
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by bypassing user authentication mechanisms via a lack of proper validation of a user-supplied string before executing a system call. This could grant adversaries root access to execute arbitrary code.
References
|
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by bypassing user authentication mechanisms via a lack of proper validation of a user-supplied string before executing a system call. This could grant adversaries root access to execute arbitrary code.
References
|
| CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers.
References
|
| CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers.
References
|
| CVE-2021-22017 | VMware vCenter Server Improper Access Control | primary_impact | T1090.001 | Internal Proxy |
Comments
The vulnerability in Rhttproxy within VMware's vCenter Server arises from an improper implementation of URI normalization. Attackers with network access to port 443 on the vCenter Server exploit this flaw by sending specially crafted requests, allowing them to bypass the proxy mechanism. This exploitation grants unauthorized access to internal endpoints, potentially exposing sensitive information.
References
|
| CVE-2021-22017 | VMware vCenter Server Improper Access Control | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
The vulnerability in Rhttproxy within VMware's vCenter Server arises from an improper implementation of URI normalization. Attackers with network access to port 443 on the vCenter Server exploit this flaw by sending specially crafted requests, allowing them to bypass the proxy mechanism. This exploitation grants unauthorized access to internal endpoints, potentially exposing sensitive information.
References
|
| CVE-2022-20821 | Cisco IOS XR Open Port Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by an unauthenticated, remote user who can access the Redis instance via port 6379 due to a health check RPM issue in IOS XR software. A successful exploitation of this vulnerability could allow an attacker the ability to write to the Redis in-memory database, write arbitrary files to the file system, or retrieve information about the Redis database. This vulnerability has been identified as being exploited in the wild, but specific details have not been released.
References
|
| CVE-2022-20703 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This Digital Signature Verification Bypass vulnerability is exploited by an unauthenticated, local attacker. The attacker exploits an improper verification of software images that could allow the attacker to install and boot malicious images or execute unsigned binaries.
References
|
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | primary_impact | T1046 | Network Service Discovery |
Comments
This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services.
References
|
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services.
References
|
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | secondary_impact | T1588.001 | Malware |
Comments
This vulnerability is exploited by an adversary who has already gained network access to the vCenter Server. The adversary sends a crafted payload to the server that has a vulnerable DCERPC protocol and causes an out-of-bounds write on the jmp rax instruction. Adversary group UNC3886 has been attributed to leveraging this vulnerability in the wild to establish a backdoor in victim vCenter servers.
References
|
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited by an adversary who has already gained network access to the vCenter Server. The adversary sends a crafted payload to the server that has a vulnerable DCERPC protocol and causes an out-of-bounds write on the jmp rax instruction. Adversary group UNC3886 has been attributed to leveraging this vulnerability in the wild to establish a backdoor in victim vCenter servers.
References
|
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | secondary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges.
References
|
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | primary_impact | T1212 | Exploitation for Credential Access |
Comments
This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges.
References
|
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges.
References
|
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | secondary_impact | T1608.001 | Upload Malware |
Comments
This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named "ESXi Admins" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments.
References
|
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named "ESXi Admins" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments.
References
|
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named "ESXi Admins" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments.
References
|
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited through multiple unrestricted uploads. Adversaries with authenticated administrator privileges leverage this vulnerability to perform unauthorized file writes on the system via a maliciously crafted archive upload within the administrator web interface in Pulse Connect Secure.
References
|
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through multiple unrestricted uploads. Adversaries with authenticated administrator privileges leverage this vulnerability to perform unauthorized file writes on the system via a maliciously crafted archive upload within the administrator web interface in Pulse Connect Secure.
References
|
| CVE-2021-22899 | Ivanti Pulse Connect Secure Command Injection Vulnerability | primary_impact | T1059.003 | Windows Command Shell |
Comments
This vulnerability is exploited through a command injection weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution on the target system via the Windows Resource Profiles Feature.
References
|
| CVE-2021-22899 | Ivanti Pulse Connect Secure Command Injection Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through a command injection weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution on the target system via the Windows Resource Profiles Feature.
References
|
| CVE-2021-22894 | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a buffer overflow weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution with root privileges on the Pulse Connect Secure gateway by manipulating input buffers.
References
|
| CVE-2021-22894 | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through a buffer overflow weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution with root privileges on the Pulse Connect Secure gateway by manipulating input buffers.
References
|
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.
References
|
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.
References
|
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.
References
|
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks.
References
|
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks.
References
|
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | primary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks.
References
|
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks.
References
|
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise.
References
|
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise.
References
|
| CVE-2023-36851 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on SRX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `webauth_operation.php` endpoint, which does not require authentication. This manipulation allows attackers to cause limited impact to the file system integrity, potentially enabling further exploitation.
References
|
| CVE-2023-36851 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on SRX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `webauth_operation.php` endpoint, which does not require authentication. This manipulation allows attackers to cause limited impact to the file system integrity, potentially enabling further exploitation.
References
|
| CVE-2023-36847 | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on EX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `installAppPackage.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system and enabling attackers to chain this vulnerability with others, potentially leading to further exploitation.
References
|
| CVE-2023-36847 | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on EX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `installAppPackage.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system and enabling attackers to chain this vulnerability with others, potentially leading to further exploitation.
References
|
| CVE-2023-36846 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution.
References
|
| CVE-2023-36846 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution.
References
|
| CVE-2023-36845 | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web interface of Juniper Networks Junos OS, affecting EX Series switches and SRX Series firewalls. Attackers leverage this vulnerability to gain initial access by crafting a request that sets the PHPRC variable, thereby altering the PHP execution environment. This manipulation enables the injection and execution of arbitrary code. By exploiting the auto_prepend_file and allow_url_include PHP features, attackers can include a base64 encoded PHP payload using the data:// wrapper. This method allows them to execute code within a confined FreeBSD jail environment, with the potential to escalate privileges by stealing authentication tokens from a user logged into the J-Web application, ultimately enabling unauthorized SSH access with elevated privileges.
References
|
| CVE-2023-36845 | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web interface of Juniper Networks Junos OS, affecting EX Series switches and SRX Series firewalls. Attackers leverage this vulnerability to gain initial access by crafting a request that sets the PHPRC variable, thereby altering the PHP execution environment. This manipulation enables the injection and execution of arbitrary code. By exploiting the auto_prepend_file and allow_url_include PHP features, attackers can include a base64 encoded PHP payload using the data:// wrapper. This method allows them to execute code within a confined FreeBSD jail environment, with the potential to escalate privileges by stealing authentication tokens from a user logged into the J-Web application, ultimately enabling unauthorized SSH access with elevated privileges.
References
|
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities.
References
|
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities.
References
|
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | primary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities.
References
|
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities.
References
|
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | primary_impact | T1136 | Create Account |
Comments
This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise.
References
|
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | primary_impact | T1213 | Data from Information Repositories |
Comments
This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise.
References
|
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. This enables them to extract personally identifiable information (PII) and perform administrative actions, such as creating new accounts and making configuration changes.
References
|
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system.
References
|
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system. This vulnerability is often used in conjunction with CVE-2023-35078 (along with others) that provides unauthenticated access, enhancing the attack's capabilities. It has been actively exploited, impacting victims by leveraging both vulnerabilities together.
References
|
| CVE-2023-0669 | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group.
References
|
| CVE-2023-0669 | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | primary_impact | T1210 | Exploitation of Remote Services |
Comments
This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group.
References
|
| CVE-2023-0669 | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group.
References
|
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability | primary_impact | T1499 | Endpoint Denial of Service |
Comments
This vulnerability is exploited through a 'Rapid Reset' flaw in HTTP/2 endpoints. Attackers initiate this vulnerability by sending a crafted sequence of HTTP requests using HEADERS followed by RST_STREAM frames. This allows them to generate substantial traffic on targeted servers, significantly increasing CPU usage and leading to resource exhaustion without authentication.
References
|
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a 'Rapid Reset' flaw in HTTP/2 endpoints. Attackers initiate this vulnerability by sending a crafted sequence of HTTP requests using HEADERS followed by RST_STREAM frames. This allows them to generate substantial traffic on targeted servers, significantly increasing CPU usage and leading to resource exhaustion without authentication.
References
|
| CVE-2023-36844 | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | primary_impact | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web component of Juniper Networks Junos OS on EX Series devices. Attackers first use this vulnerability to gain control over certain environment variables by sending a crafted request, which allows them to manipulate these variables without authentication.
References
|
| CVE-2023-36844 | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web component of Juniper Networks Junos OS on EX Series devices. Attackers first use this vulnerability to gain control over certain environment variables by sending a crafted request, which allows them to manipulate these variables without authentication.
References
|
| CVE-2023-49103 | ownCloud graphapi Information Disclosure Vulnerability | primary_impact | T1552 | Unsecured Credentials |
Comments
This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys.
References
|
| CVE-2023-49103 | ownCloud graphapi Information Disclosure Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys.
References
|
| CVE-2023-49103 | ownCloud graphapi Information Disclosure Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys.
References
|
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | primary_impact | T1136 | Create Account |
Comments
This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password.
References
|
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password.
References
|
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild.
References
|
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild.
References
|
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | primary_impact | T1059.007 | JavaScript |
Comments
This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild.
References
|
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | primary_impact | T1136 | Create Account |
Comments
This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild.
References
|
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild.
References
|
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system
This CVE was exploited after the adversary exploited CVE-2023-20198.
References
|
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system
This CVE was exploited after the adversary exploited CVE-2023-20198.
References
|
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write an implant to the file system, further compromising the device.
This CVE was exploited after the adversary exploited CVE-2023-20198.
References
|
| CVE-2023-42793 | JetBrains TeamCity Authentication Bypass Vulnerability | primary_impact | T1059.003 | Windows Command Shell |
Comments
This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files.
References
|
| CVE-2023-42793 | JetBrains TeamCity Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files.
References
|
| CVE-2024-4577 | PHP-CGI OS Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands.
References
|
| CVE-2024-4577 | PHP-CGI OS Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands.
References
|
| CVE-2024-4671 | Google Chromium Visuals Use-After-Free Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-4671 is a use-after-free vulnerability where an adversary can perform a sandbox escape via a maliciously-crafted HTML page.
References
|
| CVE-2024-4671 | Google Chromium Visuals Use-After-Free Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
CVE-2024-4671 is a use-after-free vulnerability where an adversary can perform a sandbox escape via a maliciously-crafted HTML page.
References
|
| CVE-2024-4761 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-4761 is an out of bounds write vulnerability that allows a remote attacker to perform an out of bounds memory write via a crafted HTML page.
References
|
| CVE-2024-4879 | ServiceNow Improper Input Validation Vulnerability | primary_impact | T1190 | Exploit Public-Facing Application |
Comments
CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit.
References
|
| CVE-2024-4879 | ServiceNow Improper Input Validation Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit.
References
|
| CVE-2024-4947 | Google Chromium V8 Type Confusion Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-4947 is a type confusion vulnerability in Chrome's V8 JavaScript engine.
Adversaries have been observed exploiting this vulnerability by hosting a web-based game on a site that triggered the vulnerability and executed arbitrary code.
Adversaries promoted the game on social media and through emails.
References
|
| CVE-2024-4947 | Google Chromium V8 Type Confusion Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
CVE-2024-4947 is a type confusion vulnerability in Chrome's V8 JavaScript engine.
Adversaries have been observed exploiting this vulnerability by hosting a web-based game on a site that triggered the vulnerability and executed arbitrary code.
Adversaries promoted the game on social media and through emails.
References
|
| CVE-2024-4978 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.
References
|
| CVE-2024-4978 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.
References
|
| CVE-2024-4978 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.
References
|
| CVE-2024-4978 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | exploitation_technique | T1195.002 | Compromise Software Supply Chain |
Comments
CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.
References
|
| CVE-2024-5217 | ServiceNow Incomplete List of Disallowed Inputs Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
CVE-2024-5217 is an input validation vulnerability that could enable an unauthenticated user to remotely execute code within the context of the Now Platform due to incomplete input validation in a GlideExpression Script.
References
|
| CVE-2022-29303 | SolarView Compact Command Injection Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server.
Reports indicate that the vulnerability have been exploited by operators of Mirai botnet malware.
References
|
| CVE-2022-29303 | SolarView Compact Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server.
Reports indicate that the vulnerability have been exploited by operators of Mirai botnet malware.
References
|
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | secondary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
References
|
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | secondary_impact | T1070 | Indicator Removal |
Comments
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
References
|
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | secondary_impact | T1498 | Network Denial of Service |
Comments
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
References
|
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | primary_impact | T1496 | Resource Hijacking |
Comments
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
References
|
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | exploitation_technique | T1106 | Native API |
Comments
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | secondary_impact | T1087 | Account Discovery |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | secondary_impact | T1087.001 | Local Account |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | primary_impact | T1059.003 | Windows Command Shell |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | exploitation_technique | T1133 | External Remote Services |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.
References
|
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | secondary_impact | T1087.002 | Domain Account |
Comments
CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.
References
|
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | primary_impact | T1505.003 | Web Shell |
Comments
CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.
References
|
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | exploitation_technique | T1202 | Indirect Command Execution |
Comments
CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1112 | Modify Registry |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1053 | Scheduled Task/Job |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2022-29303 | SolarView Compact Command Injection Vulnerability | exploitation_technique | T1505 | Server Software Component |
Comments
CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server.
Reports indicate that the vulnerability have been exploited by operators of Mirai botnet malware.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | exploitation_technique | T1204 | User Execution |
Comments
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
References
|
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.
References
|
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.
References
|
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.
References
|
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | primary_impact | T1082 | System Information Discovery |
Comments
CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.
References
|
| CVE-2023-49897 | FXC AE1021, AE1021PE OS Command Injection Vulnerability | secondary_impact | T1498 | Network Denial of Service |
Comments
CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2023-49897 | FXC AE1021, AE1021PE OS Command Injection Vulnerability | primary_impact | T1496 | Resource Hijacking |
Comments
CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2023-49897 | FXC AE1021, AE1021PE OS Command Injection Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2023-47565 | QNAP VioStor NVR OS Command Injection Vulnerability | secondary_impact | T1498 | Network Denial of Service |
Comments
CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2023-47565 | QNAP VioStor NVR OS Command Injection Vulnerability | primary_impact | T1496 | Resource Hijacking |
Comments
CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | exploitation_technique | T1221 | Template Injection |
Comments
CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.
References
|
| CVE-2023-47565 | QNAP VioStor NVR OS Command Injection Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.
References
|
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | secondary_impact | T1003.003 | NTDS |
Comments
CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.
References
|
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | secondary_impact | T1003.008 | /etc/passwd and /etc/shadow |
Comments
CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.
References
|
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | secondary_impact | T1059.004 | Unix Shell |
Comments
CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.
References
|
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | primary_impact | T1005 | Data from Local System |
Comments
CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.
References
|
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | exploitation_technique | T1202 | Indirect Command Execution |
Comments
CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.
References
|
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | secondary_impact | T1608.001 | Upload Malware |
Comments
This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.
References
|
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.
References
|
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.
References
|
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | secondary_impact | T1053.005 | Scheduled Task |
Comments
This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.
References
|
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | primary_impact | T1059.004 | Unix Shell |
Comments
This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.
References
|
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.
References
|
| CVE-2023-27524 | Apache Superset Insecure Default Initialization of Resource Vulnerability | primary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a remote attacker who forges a session cookie leveraging user_id or _user_id set to 1 in order to log in as an administrator. A successful exploitation could allow the adversary to gain authenticated access and gain access to unauthorized resources.
References
|
| CVE-2023-27524 | Apache Superset Insecure Default Initialization of Resource Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker who forges a session cookie leveraging user_id or _user_id set to 1 in order to log in as an administrator. A successful exploitation could allow the adversary to gain authenticated access and gain access to unauthorized resources.
References
|
| CVE-2022-0028 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | primary_impact | T1498 | Network Denial of Service |
Comments
CVE-2022-0028 is a reflected amplification Distributed-Denial-of-Service (DDoS) vulnerability with Palo Alto's PAN-OS firewall software. Public reports have announced the attempted exploit of this vulnerability to produce DDOS attack.
References
|
| CVE-2022-0028 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2022-0028 is a reflected amplification Distributed-Denial-of-Service (DDoS) vulnerability with Palo Alto's PAN-OS firewall software. Public reports have announced the attempted exploit of this vulnerability to produce DDOS attack.
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1021 | Remote Services |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1003 | OS Credential Dumping |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1136 | Create Account |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
References
|
| CVE-2023-21674 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an authenticated adversary. It is identified as requiring local access via Microsoft; however, other reports have identified remote, authenticated adversaries can exploit this vulnerability. A successful exploitation would grant an attacker SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, technical details of how this was leveraged in an attack has not been publicly shared.
References
|
| CVE-2023-21674 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an authenticated adversary. It is identified as requiring local access via Microsoft; however, other reports have identified remote, authenticated adversaries can exploit this vulnerability. A successful exploitation would grant an attacker SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, technical details of how this was leveraged in an attack has not been publicly shared.
References
|
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain limited SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, no technical information has been published related to the exploitation. Microsoft has identified that successful exploitation of this vulnerability requires an attacker to win a race condition.
References
|
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain limited SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, no technical information has been published related to the exploitation. Microsoft has identified that successful exploitation of this vulnerability requires an attacker to win a race condition.
References
|
| CVE-2022-26904 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. To exploit this vulnerability, the adversary needs to already have access to the system and must also "win a race condition". If successfully exploited, the adversary would gain elevated privileges on the victim system.
This vulnerability has been identified as exploited in the wild; however, technical exploitation details have not been publicly shared.
References
|
| CVE-2022-26904 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. To exploit this vulnerability, the adversary needs to already have access to the system and must also "win a race condition". If successfully exploited, the adversary would gain elevated privileges on the victim system.
This vulnerability has been identified as exploited in the wild; however, technical exploitation details have not been publicly shared.
References
|
| CVE-2022-21919 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. The adversary gains access to the vulnerability either by social engineering, a separate exploit, or malware. Exploiting this vulnerability grants the adversary elevated privileges on the victim system.
This vulnerability has been identified as being exploited in the wild; however, technical details of how the vulnerability has been leveraged by a hacker or APT have not been publicly released.
References
|
| CVE-2022-21919 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. The adversary gains access to the vulnerability either by social engineering, a separate exploit, or malware. Exploiting this vulnerability grants the adversary elevated privileges on the victim system.
This vulnerability has been identified as being exploited in the wild; however, technical details of how the vulnerability has been leveraged by a hacker or APT have not been publicly released.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | secondary_impact | T1136.001 | Local Account |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | secondary_impact | T1211 | Exploitation for Defense Evasion |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-22718 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is leveraged by an adversary who has already gained local access to the victim system. The adversary exploits this vulnerability to elevate their privileges on the system via the Print Spooler, which could give the adversary the ability to distribute and install malicious programs on victims’ computers that can steal stored data
This vulnerability has been actively exploited by cybercriminals to gain unauthorized access to corporate networks and resources. Details about who is exploiting this vulnerability and their exact movements have not been publicly shared.
References
|
| CVE-2022-22718 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is leveraged by an adversary who has already gained local access to the victim system. The adversary exploits this vulnerability to elevate their privileges on the system via the Print Spooler, which could give the adversary the ability to distribute and install malicious programs on victims’ computers that can steal stored data
This vulnerability has been actively exploited by cybercriminals to gain unauthorized access to corporate networks and resources. Details about who is exploiting this vulnerability and their exact movements have not been publicly shared.
References
|
| CVE-2022-41073 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | secondary_impact | T1574 | Hijack Execution Flow |
Comments
This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges.
References
|
| CVE-2022-41073 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges.
References
|
| CVE-2022-41073 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges.
References
|
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system.
References
|
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system.
References
|
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system.
References
|
| CVE-2022-41033 | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.
References
|
| CVE-2022-41033 | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.
References
|
| CVE-2022-41125 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system.
References
|
| CVE-2022-41125 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system.
References
|
| CVE-2022-41125 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system.
References
|
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user.
References
|
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | secondary_impact | T1547.001 | Registry Run Keys / Startup Folder |
Comments
This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user.
References
|
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user.
References
|
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user.
References
|
| CVE-2022-24521 | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system.
References
|
| CVE-2022-24521 | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system.
References
|
| CVE-2022-24521 | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system.
References
|
| CVE-2021-36934 | Microsoft Windows SAM Local Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by a local or remote adversary who already has access to the system. The vulnerability enables the attacker to elevate their privileges due to over permissive ACLs on system file and elevate their privileges to SYSTEM level. By exploiting this vulnerability an attacker could gain the ability to run arbitrary code, install programs, view/modify/delete data, or create new user accounts with full rights.
References
|
| CVE-2021-36934 | Microsoft Windows SAM Local Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a local or remote adversary who already has access to the system. The vulnerability enables the attacker to elevate their privileges due to over permissive ACLs on system file and elevate their privileges to SYSTEM level. By exploiting this vulnerability an attacker could gain the ability to run arbitrary code, install programs, view/modify/delete data, or create new user accounts with full rights.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1573.001 | Symmetric Cryptography |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1016 | System Network Configuration Discovery |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1082 | System Information Discovery |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1059.003 | Windows Command Shell |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | secondary_impact | T1027 | Obfuscated Files or Information |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | exploitation_technique | T1566 | Phishing |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-41379 | Microsoft Windows Installer Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.
This vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released.
References
|
| CVE-2021-41379 | Microsoft Windows Installer Privilege Escalation Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.
This vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released.
References
|
| CVE-2024-27198 | JetBrains TeamCity Authentication Bypass Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string “?jsp=/app/rest/server”, and append “;.jsp” to the HTTP path parameter.
References
|
| CVE-2024-27198 | JetBrains TeamCity Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string “?jsp=/app/rest/server”, and append “;.jsp” to the HTTP path parameter.
References
|
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default "Admin" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers.
References
|
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default "Admin" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers.
References
|
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability | primary_impact | T1548 | Abuse Elevation Control Mechanism |
Comments
This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default "Admin" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers.
References
|
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default "Admin" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | secondary_impact | T1040 | Network Sniffing |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | secondary_impact | T1574 | Hijack Execution Flow |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | secondary_impact | T1557 | Adversary-in-the-Middle |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine.
It was actively exploited by Chinese state-sponsored APT groups, including "Drifting Cloud," to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.
This vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named "Pacific Rim." This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object ("libsophos.so"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.
This vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.
The attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely.
References
|
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | secondary_impact | T1041 | Exfiltration Over C2 Channel |
Comments
This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.
References
|
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | primary_impact | T1059.007 | JavaScript |
Comments
This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.
References
|
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.
References
|
| CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | secondary_impact | T1082 | System Information Discovery |
Comments
This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.
References
|
| CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.
References
|
| CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.
References
|
| CVE-2022-24682 | Zimbra Webmail Cross-Site Scripting Vulnerability | secondary_impact | T1185 | Browser Session Hijacking |
Comments
This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.
This vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.
The attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments.
References
|
| CVE-2022-24682 | Zimbra Webmail Cross-Site Scripting Vulnerability | primary_impact | T1059.007 | JavaScript |
Comments
This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.
This vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.
The attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments.
References
|
| CVE-2022-24682 | Zimbra Webmail Cross-Site Scripting Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.
This vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.
The attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments.
References
|
| CVE-2022-39197 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote attacker to execute HTML on the Cobalt Strike team server. To exploit this vulnerability, an attacker would inspect a Cobalt Strike payload and modify the username field within the payload to be malformed. This manipulation enables the attacker to execute arbitrary code by setting a malformed username in the Beacon configuration.
In a documented cybersecurity incident, a Chinese threat actor leveraged a modified version of Cobalt Strike, known as "Cobalt Strike Cat," which included a patch for CVE-2022-39197. This version was used to establish communication channels with victim systems, perform evasive post-exploitation activities, and maintain persistence.
References
|
| CVE-2022-39197 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker to execute HTML on the Cobalt Strike team server. To exploit this vulnerability, an attacker would inspect a Cobalt Strike payload and modify the username field within the payload to be malformed. This manipulation enables the attacker to execute arbitrary code by setting a malformed username in the Beacon configuration.
In a documented cybersecurity incident, a Chinese threat actor leveraged a modified version of Cobalt Strike, known as "Cobalt Strike Cat," which included a patch for CVE-2022-39197. This version was used to establish communication channels with victim systems, perform evasive post-exploitation activities, and maintain persistence.
References
|
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote attacker who has obtained administrative console access on the target system. Successful exploitation of the flaw could allow an attacker to manipulate the component to execute arbitrary commands on an affected installation. This vulnerability has been exploited in the wild.
References
|
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a remote attacker who has obtained administrative console access on the target system. Successful exploitation of the flaw could allow an attacker to manipulate the component to execute arbitrary commands on an affected installation. This vulnerability has been exploited in the wild.
References
|
| CVE-2023-7101 | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy ‘SeaSpy’ and ‘Saltwater’ malware.
References
|
| CVE-2023-7101 | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy ‘SeaSpy’ and ‘Saltwater’ malware.
References
|
| CVE-2023-7101 | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy ‘SeaSpy’ and ‘Saltwater’ malware.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1530 | Data from Cloud Storage |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1021.001 | Remote Desktop Protocol |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1482 | Domain Trust Discovery |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1083 | File and Directory Discovery |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1562.001 | Disable or Modify Tools |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1070.004 | File Deletion |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1078 | Valid Accounts |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.
The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user.
References
|
| CVE-2022-35914 | Teclib GLPI Remote Code Execution Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker via /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2, which allows PHP code injection.
in the wild exploitation details have not been publicly released for this vulnerability
References
|
| CVE-2022-35914 | Teclib GLPI Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker via /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2, which allows PHP code injection.
in the wild exploitation details have not been publicly released for this vulnerability
References
|
| CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the "/tmp" directory and changing its permissions to make it executable using "chmod." The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures.
References
|
| CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the "/tmp" directory and changing its permissions to make it executable using "chmod." The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures.
References
|
| CVE-2022-42948 | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker. The vulnerability is caused by improper escaping of HTML tags in Swing components. This flaw allows the attacker to inject crafted HTML code, enabling them to execute code within the Cobalt Strike UI. Exploitation can occur through a graphical file explorer menu, allowing attackers to perform unauthorized operations on the administrative interface.
References
|
| CVE-2022-42948 | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker. The vulnerability is caused by improper escaping of HTML tags in Swing components. This flaw allows the attacker to inject crafted HTML code, enabling them to execute code within the Cobalt Strike UI. Exploitation can occur through a graphical file explorer menu, allowing attackers to perform unauthorized operations on the administrative interface.
References
|
| CVE-2021-39144 | XStream Remote Code Execution Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.
References
|
| CVE-2021-39144 | XStream Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | secondary_impact | T1499 | Endpoint Denial of Service |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | secondary_impact | T1569.002 | Service Execution |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.
The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service.
References
|
| CVE-2021-22204 | ExifTool Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
The vulnerability is exploited by a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to improper input validation when parsing DjVu files in ExifTool. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
References
|
| CVE-2021-22204 | ExifTool Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
The vulnerability is exploited by a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to improper input validation when parsing DjVu files in ExifTool. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
References
|
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability | secondary_impact | T1048 | Exfiltration Over Alternative Protocol |
Comments
This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
This vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection.
References
|
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability | secondary_impact | T1036 | Masquerading |
Comments
This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
This vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection.
References
|
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
This vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection.
References
|
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
This vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection.
References
|
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
This vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection.
References
|
| CVE-2022-26501 | Veeam Backup & Replication Remote Code Execution Vulnerability | secondary_impact | T1036 | Masquerading |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.
This vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection.
References
|
| CVE-2022-26501 | Veeam Backup & Replication Remote Code Execution Vulnerability | secondary_impact | T1048 | Exfiltration Over Alternative Protocol |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.
This vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection.
References
|
| CVE-2022-26501 | Veeam Backup & Replication Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.
This vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection.
References
|
| CVE-2022-26501 | Veeam Backup & Replication Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.
This vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | secondary_impact | T1499.002 | Service Exhaustion Flood |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | secondary_impact | T1071 | Application Layer Protocol |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | secondary_impact | T1543 | Create or Modify System Process |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | secondary_impact | T1070 | Indicator Removal |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and IZ1H9 to cause a distributed denial of service attack.
In the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.
In the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called "ddns.sh." This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets.
References
|
| CVE-2022-26258 | D-Link DIR-820L Remote Code Execution Vulnerability | secondary_impact | T1499.002 | Service Exhaustion Flood |
Comments
This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack.
References
|
| CVE-2022-26258 | D-Link DIR-820L Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack.
References
|
| CVE-2022-26258 | D-Link DIR-820L Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack.
References
|
| CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | primary_impact | T1204.002 | Malicious File |
Comments
This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in.
References
|
| CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in.
References
|
| CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | exploitation_technique | T1566 | Phishing |
Comments
This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1005 | Data from Local System |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1489 | Service Stop |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1490 | Inhibit System Recovery |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1070.001 | Clear Windows Event Logs |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | secondary_impact | T1553.005 | Mark-of-the-Web Bypass |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | primary_impact | T1204.002 | Malicious File |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | exploitation_technique | T1566 | Phishing |
Comments
This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.
The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.
This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.
The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation.
References
|
| CVE-2022-41128 | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | secondary_impact | T1070 | Indicator Removal |
Comments
This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation.
References
|
| CVE-2022-41128 | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | primary_impact | T1203 | Exploitation for Client Execution |
Comments
This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation.
References
|
| CVE-2022-41128 | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | exploitation_technique | T1566 | Phishing |
Comments
This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation.
References
|
| CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary who has gained authentication to the Exchange Server and exploited validation issues in command-let arguments. This gives the adversary access to perform remote code execution on the server.
References
|
| CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has gained authentication to the Exchange Server and exploited validation issues in command-let arguments. This gives the adversary access to perform remote code execution on the server.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1567 | Exfiltration Over Web Service |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1482 | Domain Trust Discovery |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1087 | Account Discovery |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | primary_impact | T1059.001 | PowerShell |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1059.001 | PowerShell |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
References
|
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.
References
|
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.
References
|
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.
References
|
| CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | secondary_impact | T1505.003 | Web Shell |
Comments
In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.
References
|
| CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | primary_impact | T1059.007 | JavaScript |
Comments
In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.
References
|
| CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.
References
|
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote, unauthenticated actor to gain remote code execution via a command injection attack. This vulnerability has been exploited in the wild; however, technical details have not been publicly shared.
References
|
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote, unauthenticated actor to gain remote code execution via a command injection attack. This vulnerability has been exploited in the wild; however, technical details have not been publicly shared.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1571 | Non-Standard Port |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1071.001 | Web Protocols |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1018 | Remote System Discovery |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1046 | Network Service Discovery |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | secondary_impact | T1557.001 | LLMNR/NBT-NS Poisoning and SMB Relay |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system.
This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL.
References
|
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | secondary_impact | T1486 | Data Encrypted for Impact |
Comments
This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations.
References
|
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations.
References
|
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations.
References
|
| CVE-2023-5217 | Google Chromium libvpx Heap Buffer Overflow Vulnerability | primary_impact | T1574 | Hijack Execution Flow |
Comments
This vulnerability was exploited by a remote attacker using a crafted HTML page to trigger a heap buffer overflow in the vp8 encoding of libvpx, leading to heap corruption. This flaw was part of a spyware campaign. The exploitation allowed for program crashes or arbitrary code execution, ultimately resulting in the installation of spyware.
References
|
| CVE-2023-5217 | Google Chromium libvpx Heap Buffer Overflow Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability was exploited by a remote attacker using a crafted HTML page to trigger a heap buffer overflow in the vp8 encoding of libvpx, leading to heap corruption. This flaw was part of a spyware campaign. The exploitation allowed for program crashes or arbitrary code execution, ultimately resulting in the installation of spyware.
References
|
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability | primary_impact | T1574 | Hijack Execution Flow |
Comments
This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT.
References
|
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT.
References
|
| CVE-2023-7024 | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | primary_impact | T1574 | Hijack Execution Flow |
Comments
This heap buffer overflow vulnerability is exploited by a remote attacker via a crafted HTML page. This vulnerability has been leveraged by the NSO group to enable remote code execution within a browser's WebRTC component to install the spyware Pegasus on victim endpoints.
References
|
| CVE-2023-7024 | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This heap buffer overflow vulnerability is exploited by a remote attacker via a crafted HTML page. This vulnerability has been leveraged by the NSO group to enable remote code execution within a browser's WebRTC component to install the spyware Pegasus on victim endpoints.
References
|
| CVE-2022-29464 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | secondary_impact | T1496 | Resource Hijacking |
Comments
CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.
References
|
| CVE-2022-29464 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | primary_impact | T1202 | Indirect Command Execution |
Comments
CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.
References
|
| CVE-2022-29464 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.
References
|
| CVE-2021-39226 | Grafana Authentication Bypass Vulnerability | primary_impact | T1485 | Data Destruction |
Comments
This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published.
In exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the "public_mode" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss.
References
|
| CVE-2021-39226 | Grafana Authentication Bypass Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published.
In exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the "public_mode" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss.
References
|
| CVE-2021-31166 | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published.
The North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance.
**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only "in the wild" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here.
References
|
| CVE-2021-31166 | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published.
The North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance.
**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only "in the wild" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here.
References
|
| CVE-2022-21971 | Microsoft Windows Runtime Remote Code Execution Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
This vulnerability is exploited when an authenticated user is convinced by an attacker to download and open a specially crafted file from a website, which grants the attacker access to the victim's computer. No articles have been released to the public showing that this vulnerability has been executed in the wild or provides any information on how an exploitation is carried out.
References
|
| CVE-2022-21971 | Microsoft Windows Runtime Remote Code Execution Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This vulnerability is exploited when an authenticated user is convinced by an attacker to download and open a specially crafted file from a website, which grants the attacker access to the victim's computer. No articles have been released to the public showing that this vulnerability has been executed in the wild or provides any information on how an exploitation is carried out.
References
|
| CVE-2021-21975 | VMware Server Side Request Forgery in vRealize Operations Manager API | exploitation_technique | T1190 | Exploit Public-Facing Application |
Comments
This Server-Side Request Forgery (SSRF) vulnerability is exploited by an attacker with network access to the VMware server. This vulnerability enables the attacker to exploit an unauthenticated endpoint to send crafted requests to internal or external systems. By doing so, the attacker can potentially steal administrative credentials. Once these credentials are compromised, the attacker could gain maximum privileges within the application, enabling them to alter configurations and intercept sensitive data. This exploitation could lead to unauthorized access and manipulation of the application.
References
|
| CVE-2022-3075 | Google Chromium Mojo Insufficient Data Validation Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This data validation vulnerability is exploited by a remote attacker who compromised the renderer process via a crafted HTML page to potentially perform a sandbox escape.
Exploitation in the wild techniques have not been published by Google.
References
|
| CVE-2023-2136 | Google Chrome Skia Integer Overflow Vulnerability | exploitation_technique | T1204.001 | Malicious Link |
Comments
This integer overflow vulnerability is exploited by a remote attacker who has already compromised the renderer process of Google Chrome. Exploiting this vulnerability might lead to incorrect rendering, memory corruption, and arbitrary code execution that could grant the adversary unauthorized access to the system.
Exploitation in the wild techniques have not been publicly released to reduce further abuse.
References
|
| CVE-2012-0754 | Adobe Flash Player Memory Corruption Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
This vulnerability is exploited via a maliciously-crafted MP4 file. As a result of the exploit, malicious software is installed on the target machine.
References
|
| CVE-2012-0754 | Adobe Flash Player Memory Corruption Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
This vulnerability is exploited via a maliciously-crafted MP4 file. As a result of the exploit, malicious software is installed on the target machine.
References
|
