Butter Анализ

IOB - Indicator of Behavior (38)

Временная шкала

Язык

en34
zh4

Страна

cn24
us14

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

Webmin4
php-fusion2
spring-boot-actuator-logview2
Spring Framework2
Twisted2

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemEPSSCTICVE
1Webmin UI Command apt-lib.pl межсайтовый скриптинг6.66.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.969250.05CVE-2022-36446
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации5.35.2$5k-$25kРасчетHighWorkaround0.020160.02CVE-2007-1192
3MajorDoMo thumb.php эскалация привилегий5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.736900.00CVE-2023-50917
4phpMyAdmin раскрытие информации5.35.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.001360.04CVE-2022-0813
5phpMyAdmin Two-factor Authentication слабая аутентификация6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000540.05CVE-2022-23807
6Codoforum Admin Panel эскалация привилегий5.75.7$0-$5k$0-$5kNot DefinedNot Defined0.266200.04CVE-2022-31854
7Inspur ClusterEngine Control Server эскалация привилегий8.07.6$0-$5k$0-$5kProof-of-ConceptNot Defined0.050940.07CVE-2020-21224
8Maianscriptworld Maian Cart Elfinder Plugin эскалация привилегий6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.269060.00CVE-2021-32172
9Snap Creek Duplicator installer.php эскалация привилегий8.58.2$0-$5k$0-$5kHighOfficial Fix0.839540.00CVE-2018-17207
10Cisco SD-WAN Software/SD-WAN vManage Software MPLS повреждение памяти5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.001710.00CVE-2021-1614
11Webmin User неизвестная уязвимость3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.012750.00CVE-2021-31762
12Webmin Process межсайтовый скриптинг3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.960240.00CVE-2021-31761
13Alt-N MDaemon Worldclient эскалация привилегий4.94.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000900.06CVE-2021-27182
14php-fusion downloads.php эскалация привилегий7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.949640.00CVE-2020-24949
15Twisted twisted.web эскалация привилегий6.66.2$0-$5k$0-$5kNot DefinedOfficial Fix0.002400.00CVE-2019-12387
16Apache HTTP Server mod_proxy_http отказ в обслуживании5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.006190.05CVE-2020-13950
17Apache Tomcat NTFS File System File.getCanonicalPath раскрытие информации5.15.1$5k-$25k$5k-$25kNot DefinedNot Defined0.002320.03CVE-2021-24122
18Webmin Default Configuration shadow обход каталога7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.001480.00CVE-2018-8712
19Webmin Package Updates Module update.cgi эскалация привилегий8.88.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.123310.06CVE-2019-12840
20spring-boot-actuator-logview обход каталога6.36.3$0-$5k$0-$5kNot DefinedOfficial Fix0.967320.00CVE-2021-21234

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
137.187.154.79ns320600.ip-37-187-154.euButter13.02.2022verifiedВысокий
246.105.103.169ns383264.ip-46-105-103.euButter13.02.2022verifiedВысокий
3XXX.XX.XXX.XXXXxxxxx13.02.2022verifiedВысокий
4XXX.XXX.XX.XXxxx.xxx.xx.xx.xxxxxx.xxxxx.xxxXxxxxx13.02.2022verifiedВысокий
5XXX.XXX.XX.XXxxx.xxx.xx.xx.xxxxxx.xxxxx.xxxXxxxxx13.02.2022verifiedВысокий
6XXX.XXX.XX.XXXxxx.xxx.xx.xxx.xxxxxx.xxxxx.xxxXxxxxx13.02.2022verifiedВысокий
7XXX.X.XXX.XXXXxxxxx13.02.2022verifiedВысокий
8XXX.XX.XXX.XXXxxxxx13.02.2022verifiedВысокий
9XXX.XX.XXX.XXXXxxxxx13.02.2022verifiedВысокий
10XXX.XXX.XXX.XXXxxxxx13.02.2022verifiedВысокий

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueКлассУязвимостиВектор доступаТипУверенность
1T1006CAPEC-126CWE-22Path TraversalpredictiveВысокий
2T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveВысокий
3TXXXXCAPEC-242CWE-XXXxxxxxxx XxxxxxxxxpredictiveВысокий
4TXXXX.XXXCAPEC-209CWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveВысокий
5TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
6TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveВысокий
7TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveВысокий
8TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий
9TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveВысокий

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1File/etc/shadowpredictiveСредний
2Fileawstats.plpredictiveСредний
3Filecjson.cpredictiveНизкий
4Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveВысокий
5Filexxxxxxxxx/xxxxxxxxx.xxxpredictiveВысокий
6Filexxxxxxxxx.xxxpredictiveВысокий
7Filexxx/xxxx/xxxx_xxxxxxxxxx_xxxx.xpredictiveВысокий
8Filexxxxx.xxxpredictiveСредний
9Filexxxxxxx.xxxpredictiveСредний
10Filexxxxxx.xxxpredictiveСредний
11Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictiveВысокий
12Libraryxxxxxxxx/xxx-xxx.xxpredictiveВысокий
13ArgumentxxxxxxpredictiveНизкий
14ArgumentxxxxpredictiveНизкий
15Argumentxxxx/xxx_xxxxxxxxxpredictiveВысокий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!