THREATS 2023 August

January(56) February(146) March(137) April(491) May(161) June(162) July(242) August(171) September(238) October(161) November(135) December(70)

DATE	NAME	CATEGORY	SUBCATE	INFO
31.8.23	MMRat	Malware	Android RAT	The Trend Micro Mobile Application Reputation Service (MARS) team discovered a new, fully undetected Android banking trojan, dubbed MMRat, that has been targeting mobile users in Southeast Asia since late June 2023.
31.8.23	BadBazaar	Malware	Android	ESET researchers have discovered active campaigns linked to the China-aligned APT group known as GREF, distributing espionage code that has previously targeted Uyghurs
31.8.23	CVE-2023-36846	Vulnerebility	CVE	A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
31.8.23	CVE-2023-36845	Vulnerebility	CVE	A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.
31.8.23	CVE-2023-32315	Vulnerebility	CVE	Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment.
31.8.23	CVE-2023-33246	Vulnerebility	CVE	Apache RocketMQ Remote Code Execution Vulnerability
31.8.23	CVE-2023-34039	Vulnerebility	CVE	Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.
31.8.23	CVE-2023-20887	Vulnerebility	CVE	Aria Operations for Networks contains a command injection vulnerability.
31.8.23	Operation Duck Hunt	Operation	Operation	The FBI has led a multinational law enforcement operation that has successfully dismantled QakBot, a leading malware loader used by cybercriminals to deploy ransomware.
31.8.23	CVE-2023-2868	Vulnerebility	CVE	A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006
31.8.23	DarkGate	Malware	Loader	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.
29.8.23	CVE-2023-3519	Vulnerebility	CVE	Unauthenticated remote code execution
29.8.23	AitM	Attack	Phishing	adversary-in-the-middle attack to steal session cookies and gain access to victims' email accounts.
29.8.23	POWER PLATFORM PRIVILEGE ESCALATION	Exploit	Exploit	An attacker could leverage this abandoned URL to redirect authorization codes to themselves, exchanging the ill-gotten authorization codes for access tokens.
29.8.23	Rust	Malware	Python	Phylum routinely identifies malware and other software supply chain attacks targeting high-value, critical assets: an organization’s software developers.
29.8.23	KmsdBot	BOTNET	BOTNET	The Akamai SIRT has been tracking the Kmsdx botnet campaign since November 2022, and now we have another new evolution
25.8.23	CVE-2023-2868	Vulnerebility	CVE	A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006.
25.8.23	CollectionRAT	Malware	RAT	Lazarus Group's infrastructure reuse leads to discovery of new malware
25.8.23	QuiteRAT	Malware	RAT	QuiteRAT is a simple remote access trojan written with the help of Qt libraries.
24.8.23	Telekopye	Malware	Malware	Analysis of Telegram bot that helps cybercriminals scam people on online marketplaces
24.8.23	Whiffy Recon	Malware	Loader	SMOKE LOADER DROPS WHIFFY RECON WI-FI SCANNING AND GEOLOCATION MALWARE
24.8.23	CVE-2023-38831	Vulnerebility	CVE	RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
24.8.23	CVE-2023-32315	Vulnerebility	CVE	Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment.
23.8.23	Luna Grabber	Malware	Stealer	ReversingLabs researchers have identified more than a dozen malicious packages targeting Roblox API users on the npm repository. This latest campaign recalls a 2021 attack.
23.8.23	Spacecolon	Malware	Tool	Analysis of Spacecolon, a toolset used to deploy Scarab ransomware on vulnerable servers, and its operators, CosmicBeetle
23.8.23	CraxsRAT	Malware	RAT	‘Malware-as-a-service’ has been around for some time, however of late, it has become increasingly convenient for cybercriminals to kickstart their activities without having to learn malware development itself.
23.8.23	CypherRat	Malware	RAT	The malware has been released on github at https://github.com/EVLF/Cypher-Rat-Source-Code
23.8.23	Taskhub CRM Tool 2.8.6 - SQL Injection	Exploit	WebApps	PHP
23.8.23	OVOO Movie Portal CMS v3.3.3 - SQL Injection	Exploit	WebApps	PHP
23.8.23	Global - Multi School Management System Express v1.0- SQL Injection	Exploit	WebApps	PHP
23.8.23	Color Prediction Game v1.0 - SQL Injection	Exploit	WebApps	PHP
23.8.23	Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)	Exploit	WebApps	PHP
23.8.23	PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities	Exploit	WebApps	PHP
23.8.23	EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download	Exploit	Remote	Hardware
23.8.23	EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)	Exploit	Remote	Hardware
23.8.23	EuroTel ETL3100 - Transmitter Default Credentials	Exploit	Remote	Hardware
23.8.23	Dolibarr Version 17.0.1 - Stored XSS	Exploit	WebApps	PHP
23.8.23	Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions	Exploit	Local	Windows
23.8.23	TSPlus 16.0.0.0 - Remote Work Insecure Credential storage	Exploit	Remote	Windows
23.8.23	TSplus 16.0.0.0 - Remote Work Insecure Files and Folders	Exploit	Remote	Windows
23.8.23	TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions	Exploit	Remote	Windows
23.8.23	OutSystems Service Studio 11.53.30 - DLL Hijacking	Exploit	Local	Windows
23.8.23	TP-Link Archer AX21 - Unauthenticated Command Injection	Exploit	Remote	Hardware
23.8.23	Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)	Exploit	WebApps	Python
23.8.23	Request-Baskets v1.2.1 - Server-side request forgery (SSRF)	Exploit	WebApps	Python
23.8.23	systemd 246 - Local Privilege Escalation	Exploit	Local	Linux
23.8.23	Emagic Data Center Management Suite v6.0 - OS Command Injection	Exploit	WebApps	PHP
23.8.23	PHPJabbers Vacation Rental Script 4.0 - CSRF	Exploit	WebApps	PHP
23.8.23	Social-Commerce 3.1.6 - Reflected XSS	Exploit	WebApps	PHP
23.8.23	mooSocial 3.1.8 - Reflected XSS	Exploit	WebApps	PHP
23.8.23	Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)	Exploit	WebApps	Python
23.8.23	Lucee 5.4.2.17 - Authenticated Reflected XSS	Exploit	WebApps	Multiple
23.8.23	Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure	Exploit	WebApps	PHP
22.8.23	PlugX	Malware	RAT	RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully.
22.8.23	Xloader	Malware	MacOS	Xloader is a Rebranding of Formbook malware (mainly a stealer), available for macOS as well.
22.8.23	CVE-2023-38035	Vulnerebility	CVE	A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
22.8.23	CVE-2023-26359	Vulnerebility	CVE	Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user.
21.8.23	CVE-2023-40477	Vulnerebility	CVE	(CVSS score: 7.8), the vulnerability has been described as a case of improper validation while processing recovery volumes.
21.8.23	AdLoad	Malware	MacOS	AT&T Alien Labs researchers recently discovered a massive campaign of threats delivering a proxy server application to Windows machines.
21.8.23	HiatusRAT	Malware	RAT	In March 2023, Lumen Black Lotus Labs reported on a complex campaign called “HiatusRAT” that infected over 100 edge networking devices globally.
19.8.23	MAR-10459736.r1.v1 WHIRLPOOL Backdoor	CERT	CERT	CISA obtained a variant of the WHIRLPOOL backdoor. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG).
19.8.23	Parsec Remote Desktop App is prone to a local elevation of privilege due to a logical flaw in its code integrity verification process	Alert	Alert	Parsec updater for Windows was prone to a local privilege escalation vulnerability, this vulnerability allowed a local user with Parsec access to gain NT_AUTHORITY/SYSTEM privileges.
19.8.23	CVE-2023-36847	Vulnerebility	CVE	A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
19.8.23	CVE-2023-36846	Vulnerebility	CVE	A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
19.8.23	CVE-2023-36845	Vulnerebility	CVE	A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.
19.8.23	CVE-2023-36844	Vulnerebility	CVE	A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.
19.8.23	LABRAT	Operation	Operation	LABRAT: Stealthy Cryptojacking and Proxyjacking Campaign Targeting GitLab
19.8.23	CVE-2021-22205	Vulnerebility	CVE	An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
19.8.23	CVE-2023-32560	Vulnerebility	CVE	(CVSS score: 9.8), are stack-based buffer overflows in Ivanti Avalanche WLAvanacheServer.exe v6.4.0.0.
19.8.23	CVE-2023-3519	Vulnerebility	CVE	Unauthenticated remote code execution
19.8.23	CVE-2023-38257	Vulnerebility	CVE	(CVSS score: 7.5) - An insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
19.8.23	CVE-2023-35763	Vulnerebility	CVE	(CVSS score: 5.5) - A cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
19.8.23	CVE-2023-35189	Vulnerebility	CVE	(CVSS score: 10.0) - A remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
19.8.23	CVE-2023-33871	Vulnerebility	CVE	(CVSS score: 7.5) - A directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the server's webroot.
19.8.23	Gigabud RAT	Malware	RAT	Gigabud is the name of an Android Remote Access Trojan (RAT) Android that can record the victim's screen and steal banking credentials by abusing the Accessibility Service.
19.8.23	The Week in Ransomware - August 18th 2023 - LockBit on Thin Ice	Ransom	Ransom	While there was quite a bit of ransomware news this week, the highlighted story was the release of Jon DiMaggio's third article in the Ransomware Diaries series, with the focus of this article on the LockBit ransomware operation.
14.8.23	QwixxRAT	Malware	RAT	A new threat has emerged in the realm of cybersecurity, referred to as QwixxRAT. Both businesses and individual users are at risk, as this Trojan silently infiltrates devices, casting a wide net of data extraction.
14.8.23	CVE-2022-24086	Vulnerebility	CVE	Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
14.8.23	HYPERSCRAPE	Malware	Stealer	New Iranian APT data extraction tool
14.8.23	JanelaRAT	Malware	RAT	According to Zscaler, JanelaRAT is a heavily modified variant of BX RAT.
13.8.23	Python Parsing Error Enabling Bypass CVE-2023-24329	Alert	Alert	An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
13.8.23	MAR-10454006.r4.v2 SEASPY and WHIRLPOOL Backdoors	CERT	CERT	CISA obtained four malware samples - including SEASPY and WHIRLPOOL backdoors. The device was compromised by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG).
13.8.23	CVE-2023-24329	Vulnerebility	CVE	An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
13.8.23	NightClub	Malware	Backdoor	MoustachedBouncer: Espionage against foreign diplomats in Belarus
12.8.23	XWorm	Malware	RAT	Malware with wide range of capabilities ranging from RAT to ransomware.
12.8.23	The Week in Ransomware - August 11th 2023 - Targeting Healthcare	Ransom	Ransom	While some ransomware operations claim not to target hospitals, one relatively new ransomware gang named Rhysida doesn't seem to care.
12.8.23	CODESYS V3 SDK	Vulnerebility	CVE	Multiple high severity vulnerabilities in CODESYS V3 SDK could lead to RCE or DoS
12.8.23	CVE-2023-38180	Vulnerebility	CVE	(CVSS score: 7.5), the high-severity flaw relates to a case denial-of-service (DoS) impacting .NET and Visual Studio.
12.8.23	Statc Stealer	Malware	Stealer	Statc Stealer. Statc Stealer is a sophisticated malware that infects devices powered by Windows, gains access to computer systems, and steals sensitive information.
11.8.23	CVE-2022-44681	Vulnerebility	CVE	Windows Print Spooler Elevation of Privilege Vulnerability
11.8.23	CVE-2022-23825	Vulnerebility	CVE	Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
11.8.23	CVE-2022-44611	Vulnerebility	CVE	Windows Print Spooler Elevation of Privilege Vulnerability
11.8.23	CVE-2023-20569	Vulnerebility	CVE	A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction.
11.8.23	CVE-2022-40982	Vulnerebility	CVE	Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
11.8.23	CVE-2023-20583	Vulnerebility	CVE	A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information.
11.8.23	Spyder	Malware	Malware	Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors
11.8.23	ShadowPad	Malware	Malware	Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors
11.8.23	FunnySwitch	Malware	Malware	RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
11.8.23	Brute Ratel C4	Malware	Malware	Brute Ratel is a a Customized Command and Control Center for Red Team and Adversary Simulation
11.8.23	CVE-2023-38154	Vulnerebility	CVE	Windows Kernel Elevation of Privilege Vulnerability
11.8.23	CVE-2023-35386	Vulnerebility	CVE	Windows Kernel Elevation of Privilege Vulnerability
11.8.23	CVE-2023-35382	Vulnerebility	CVE	Windows Kernel Elevation of Privilege Vulnerability
11.8.23	CVE-2023-35380	Vulnerebility	CVE	Windows Kernel Elevation of Privilege Vulnerability
11.8.23	CVE-2023-35359	Vulnerebility	CVE	Windows Kernel Elevation of Privilege Vulnerability
11.8.23	CVE-2023-38180	Vulnerebility	CVE	.NET and Visual Studio Denial of Service Vulnerability
11.8.23	CVE-2023-38185	Vulnerebility	CVE	Microsoft Exchange Server Remote Code Execution Vulnerability
11.8.23	CVE-2023-38182	Vulnerebility	CVE	Microsoft Exchange Server Remote Code Execution Vulnerability
11.8.23	CVE-2023-35388	Vulnerebility	CVE	Microsoft Exchange Server Remote Code Execution Vulnerability
11.8.23	CVE-2023-20569	Vulnerebility	CVE	In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the remote code execution vulnerability.
8.8.23	Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)	Exploit	DoS	Windows
8.8.23	WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution	Exploit	WebApps	PHP
8.8.23	WordPress adivaha Travel Plugin 2.3 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	Webedition CMS v2.9.8.8 - Stored XSS	Exploit	WebApps	PHP
8.8.23	Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)	Exploit	WebApps	PHP
8.8.23	Webutler v3.2 - Remote Code Execution (RCE)	Exploit	WebApps	PHP
8.8.23	Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR	Exploit	WebApps	PHP
8.8.23	Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access	Exploit	WebApps	PHP
8.8.23	Shelly PRO 4PM v0.11.0 - Authentication Bypass	Exploit	Remote	Hardware
8.8.23	Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload	Exploit	WebApps	PHP
8.8.23	WordPress adivaha Travel Plugin 2.3 - SQL Injection	Exploit	WebApps	PHP
8.8.23	Academy LMS 6.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Rental Property Booking 2.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Taxi Booking 2.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Cleaning Business 1.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Night Club Booking 1.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Service Booking Script 1.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	JLex GuestBook 1.6.4 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)	Exploit	WebApps	Multiple
8.8.23	Joomla JLex Review 6.0.1 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS	Exploit	WebApps	PHP
8.8.23	Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting	Exploit	WebApps	PHP
8.8.23	ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)	Exploit	Remote	Hardware
8.8.23	LOLBAS	Malware	Downloader	To that end, the Israeli cybersecurity company said it uncovered nine LOLBAS downloaders and three executors that could enable adversaries to download and execute "more robust malware" on infected hosts.
8.8.23	OpenBullet	Malware	RAT	Multiple malicious OpenBullet configuration files are being shared within these communities, resulting in the installation of a Remote Access Trojan (RAT) on the user’s machine.
8.8.23	OpenCarrot	Malware	Backdoor	North Korea Compromises Sanctioned Russian Missile Engineering Company
7.8.23	SkidMap	Malware	Linux	While analyzing the latest logs of our honeypot located in central Europe, we found a rather interesting entry that repeated again less than two weeks later.
5.8.23	CVE-2023-27350	Vulnerebility	CVE	This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).
5.8.23	CVE-2023-39143	Vulnerebility	CVE	PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.
3.8.23	SharkBot	Malware	Android	SharkBot is a piece of malicious software targeting Android Operating Systems (OSes).
3.8.23	Phorpiex	Malware	RAT	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.
3.8.23	Ekipa RAT	Malware	RAT	Malicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT
3.8.23	CVE-2023-24489	Vulnerebility	CVE	A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
3.8.23	CVE-2023-3519	Vulnerebility	CVE	Unauthenticated remote code execution
3.8.23	GraphDrop	Malware	Backdoor	PANW Unit 42 describes this malware as capable of up and downloading files as well as loading additional shellcode payloads into selected target processes.
3.8.23	CVE-2023-35081	Vulnerebility	CVE	(CVSS score: 7.2) - A path traversal vulnerability is discovered in Ivanti EPMM that allows an attacker to write arbitrary files onto the appliance.
3.8.23	CVE-2023-35078	Vulnerebility	CVE	(CVSS score: 10.0) - An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
3.8.23	CVE-2023-35082	Vulnerebility	CVE	CVE
2.8.23	CVE-2023-35078	Vulnerebility	CVE	Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available.
2.8.23	NodeStealer 2.0	Malware	Stealer	About eight months later, in March 2023, FakeGPT, a new variant of a fake ChatGPT Chrome extension that steals Facebook Ad accounts, was reported. Unit 42 also reported on ChatGPT-themed scam attacks in April 2023
2.8.23	General Device Manager 2.5.2.2 - Buffer Overflow (SEH)	Exploit	Local	Windows
2.8.23	Joomla iProperty Real Estate 4.1.1 - Reflected XSS	Exploit	WebApps	PHP
2.8.23	Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)	Exploit	WebApps	PHP
2.8.23	Joomla Solidres 2.13.3 - Reflected XSS	Exploit	WebApps	PHP
2.8.23	mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory	Exploit	Local	Windows
2.8.23	copyparty 1.8.2 - Directory Traversal	Exploit	WebApps	Python
2.8.23	copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)	Exploit	WebApps	Python
2.8.23	GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution	Exploit	Local	Windows
2.8.23	WordPress Plugin AN_Gradebook 5.0.1 - SQLi	Exploit	WebApps	PHP
2.8.23	Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS	Exploit	WebApps	PHP
2.8.23	October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)	Exploit	WebApps	PHP
2.8.23	Joomla HikaShop 4.7.4 - Reflected XSS	Exploit	WebApps	PHP
2.8.23	mooDating 1.2 - Reflected Cross-site scripting (XSS)	Exploit	WebApps	PHP
2.8.23	Perch v3.2 - Persistent Cross Site Scripting (XSS)	Exploit	WebApps	PHP
2.8.23	Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)	Exploit	WebApps	PHP
2.8.23	Zomplog 3.9 - Cross-site scripting (XSS)	Exploit	WebApps	PHP
2.8.23	zomplog 3.9 - Remote Code Execution (RCE)	Exploit	WebApps	PHP
2.8.23	Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping	Exploit	Local	Multiple
2.8.23	RosarioSIS 10.8.4 - CSV Injection	Exploit	WebApps	PHP
2.8.23	Perch v3.2 - Stored XSS	Exploit	WebApps	PHP
2.8.23	Perch v3.2 - Remote Code Execution (RCE)	Exploit	WebApps	PHP
2.8.23	MAR-10454006-r1.v2 SUBMARINE Backdoor	CERT	CERT	CISA obtained seven malware samples related to a novel backdoor CISA has named SUBMARINE.
2.8.23	MAR-10454006-r2.v1 SEASPY Backdoor	CERT	CERT	CISA obtained 14 malware samples comprised of Barracuda exploit payloads and reverse shell backdoors.
2.8.23	MAR-10454006-r3.v1 Exploit Payload Backdoor	CERT	CERT	CISA obtained two SEASPY malware samples. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG).
2.8.23	h2miner	Malware	Linux	A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
2.8.23	HeadCrab	Malware	Malware	Known as HeadCrab, this advanced threat actor utilizes a state-of-the-art, custom-made malware that is undetectable by agentless and traditional anti-virus solutions
2.8.23	BADNEWS	Malware	Backdoor	is a a .NET-based modular backdoor that comes with capabilities to establish contact with a remote command-and-control (C2) server and execute commands to enumerate files.
2.8.23	ORPCBackdoor	Malware	Backdoor	Bitter, also known as Cranberry, is an advanced threat group with suspected roots in South Asia.
2.8.23	Rekoobe	Malware	Trojan	A Trojan for Winows with the same code structure and functionalities of elf.rekoobe, for Linux environment instead.
2.8.23	Rekoobe	Malware	Linux	A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers.
1.8.23	WikiLoader	Malware	Banking	Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer.