Downeks Analysis

IOB - Indicator of Behavior (13)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en14

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us10
ru4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

IBM FileNet Workplace XT2
Alt-N MDaemon2
phpMyAdmin2
FUSE2
OpenWrt2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Alt-N MDaemon Worldclient injection4.94.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000900.04CVE-2021-27182
2ABBYY FineReader License Server link following6.56.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000420.04CVE-2019-20383
3FileZilla Server PORT confused deputy4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000520.06CVE-2015-10003
4FUSE fusermount access control6.56.7$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.001340.03CVE-2018-10906
5AnyMacro AnyMacro Mail System path traversal5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.002480.02CVE-2011-2468
6IBM FileNet Workplace XT File Upload unrestricted upload7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.008980.03CVE-2016-8921
7phpMyAdmin import.php access control7.16.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.001470.03CVE-2013-4729
8OpenWrt/LEDE uhttpd cgi_handle_request Reflected cross site scripting5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.000820.02CVE-2018-19630
9OpenWrt Access Control rpcd access control7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.002350.00CVE-2018-11116
10PunBB profile.php sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.001620.00CVE-2005-1051
11Juniper Web Device Manager Authentication hard-coded credentials9.89.0$5k-$25k$0-$5kProof-of-ConceptWorkaround0.000000.06
12PHP FastCGI Process Manager php-fpm.conf.in access control5.95.2$25k-$100k$0-$5kUnprovenOfficial Fix0.000450.00CVE-2014-0185
13phpMyAdmin server_privileges.lib.php cross site scripting6.56.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.003060.00CVE-2016-2560

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
1185.141.25.68Downeks12/23/2020verifiedHigh

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/etc/config/rpcdpredictiveHigh
2Filecgi-bin/predictiveMedium
3Filexxxxxx.xxxpredictiveMedium
4Filexxx-xxx.xxxx.xxpredictiveHigh
5Filexxxxxxx.xxxpredictiveMedium
6Libraryxxxxxxxxx/xxxxxx_xxxxxxxxxx.xxx.xxxpredictiveHigh
7ArgumentxxxxxxxxxxxxxpredictiveHigh
8ArgumentxxpredictiveLow

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!