PowerPool Analyse

IOB - Indicator of Behavior (47)

Zeitverlauf

Sprache

en32
zh10
jp4
ko2

Land

cn30
us14
gb2

Akteure

Aktivitäten

Interesse

Zeitverlauf

Typ

Hersteller

Produkt

Oracle Java SE4
Atlassian JIRA2
Dan McDougall GateOne2
IBM Spectrum Scale2
GitBook2

Schwachstellen

#SchwachstelleBaseTemp0dayHeuteAusMasCTIEPSSCVE
1GitLab Community Edition/Enterprise Edition Image File Privilege Escalation6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.010.97463CVE-2021-22205
2Oracle Java SE Libraries unbekannte Schwachstelle5.95.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.00249CVE-2021-2161
3Nginx Autoindex Module Pufferüberlauf5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00845CVE-2017-20005
4Juniper ScreenOS schwache Verschlüsselung7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.02583CVE-2015-7756
5jforum User erweiterte Rechte5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.050.00289CVE-2019-7550
6Google Android System_server SkSwizzler.cpp onSetSampleX Pufferüberlauf7.57.4$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00125CVE-2019-1986
7Microsoft Azure DevOps Server unbekannte Schwachstelle6.15.3$5k-$25k$0-$5kUnprovenOfficial Fix0.000.00427CVE-2021-28459
8IBM Spectrum Scale GPFS Command Line Utility Information Disclosure5.75.7$0-$5k$0-$5kNot DefinedNot Defined0.000.00051CVE-2018-1723
9Microsoft Azure Stack Hub Information Disclosure5.95.6$5k-$25k$0-$5kUnprovenOfficial Fix0.020.00073CVE-2024-20679
10Apache Shiro API Directory Traversal8.07.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.050.00071CVE-2023-34478
11ZyXEL NAS326/NAS540 HTTP Request erweiterte Rechte9.89.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.02427CVE-2023-27992
12Google Chrome V8 erweiterte Rechte7.57.4$25k-$100k$5k-$25kNot DefinedOfficial Fix0.030.00177CVE-2022-4174
13Appsmith List Widget Cross Site Scripting3.53.4$0-$5k$0-$5kNot DefinedNot Defined0.040.00106CVE-2022-39824
14XpressEngine XE Normal Button erweiterte Rechte5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.000.00058CVE-2021-44912
15PHP SOAP Extension unserialize Information Disclosure8.17.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.040.06579CVE-2015-4600
16kube-rbac-proxy TLS Configuration schwache Verschlüsselung6.26.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00430CVE-2019-3818
17GitBook Stored Cross Site Scripting5.25.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00077CVE-2017-16019
18Oracle Java SE Libraries unbekannte Schwachstelle5.35.1$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00158CVE-2021-2163
19PostgreSQL Pufferüberlauf5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00543CVE-2021-32027
20Nginx Open Source/Plus/Ingress Controller Resolver Pufferüberlauf5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.030.58180CVE-2021-23017

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-AdresseHostnameAkteurKampagnenIdentifiziertTypAkzeptanz
127.102.106.149PowerPool31.05.2021verifiziertHigh

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (11)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasseIndicatorTypAkzeptanz
1Fileautologin.cgiprädiktivHigh
2Filecommand.phpprädiktivMedium
3Filexxxxx.xxxprädiktivMedium
4Filexxxx/xxxxxxx.xxxprädiktivHigh
5Filexxxxxx.xprädiktivMedium
6Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxprädiktivHigh
7Filexxxxxxxxxx.xxxprädiktivHigh
8ArgumentxxxprädiktivLow
9ArgumentxxxxxxxxxxxprädiktivMedium
10ArgumentxxprädiktivLow
11Input Value.%xx.../.%xx.../prädiktivHigh

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!