00536d Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (22)

Lang

en	16
zh	4
it	2

Land

us	10
ca	8
cn	4

Skådespelare

00536d	3

Intressera

Typ

Not Defined	8
Web Server	4
Wireless LAN Software	2
JavaScript Library	2
File Transfer Software	2

Säljare

Not Defined	10
Microsoft	2
Dynacolor	2
Netgear	2
IBM	2

Produkt

Microsoft IIS	2
eG Manager	2
NexusPHP	2
Dynacolor FCM-MB40	2
Netgear D6300B	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Checkmk UI förnekande av tjänsten	2.7	2.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.03	CVE-2023-23549
2	Softing smartLink SW-HT svag kryptering	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.00	CVE-2022-48193
3	PHP Date Extension parse_date.c php_parse_date informationsgivning	6.4	6.1	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00777	0.00	CVE-2017-16642
4	ImageMagick png.c ReadOnePNGImage minneskorruption	5.4	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00060	0.00	CVE-2017-11539
5	PhotoPost PHP Pro showproduct.php sql injektion	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00276	0.04	CVE-2004-0250
6	Comments comments.php sql injektion	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
7	Black Tie Project Category ID categorie.php3 Path informationsgivning	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00342	0.02	CVE-2002-0446
8	Dynacolor FCM-MB40 förfalskning på begäran över webbplatsen	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.00	CVE-2019-13401
9	eG Manager svag autentisering	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00659	0.04	CVE-2020-8591
10	NexusPHP modtask.php sql injektion	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00184	0.00	CVE-2017-12909
11	Active Auction House ItemInfo.asp sql injektion	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00685	0.00	CVE-2005-1029
12	WP Fastest Cache Plugin wpFastestCache.php rm_folder_recursively privilegier eskalering	5.6	5.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02224	0.00	CVE-2019-6726
13	AXIS 2110 Network Camera editcgi.cgi kataloggenomgång	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01492	0.02	CVE-2004-2426
14	Oracle Fusion Middleware WebLogic Server privilegier eskalering	9.0	9.0	$5k-$25k	$0-$5k	High	Not Defined	0.97573	0.02	CVE-2019-2725
15	Netgear D6300B Credential Storage nvram svag kryptering	5.4	4.6	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
16	Biscom Secure File Transfer AngularJS privilegier eskalering	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00057	0.00	CVE-2017-5246
17	IBM HTTP Server minneskorruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00359	0.03	CVE-2015-4947
18	jQuery UI dialog cross site scripting	5.2	4.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00469	0.07	CVE-2016-7103
19	Citrix XenApp XML Service Interface minneskorruption	9.9	8.6	$25k-$100k	$0-$5k	Unproven	Official Fix	0.04580	0.03	CVE-2012-5161
20	Microsoft IIS privilegier eskalering	9.9	9.9	$25k-$100k	$5k-$25k	Not Defined	Not Defined	0.08875	0.04	CVE-2010-1256

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	8.208.9.98		00536d	12/04/2022	verified	Hög
2	54.39.74.124		00536d	12/04/2022	verified	Hög
3	XX.XXX.XX.XXX		Xxxxxx	12/04/2022	verified	Hög
4	XX.XXX.XXX.XX		Xxxxxx	12/04/2022	verified	Hög
5	XXX.XXX.X.XXX	xxx.xxxx-xxxxxx.xxx	Xxxxxx	12/04/2022	verified	Hög
6	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxxxxx	12/04/2022	verified	Hög

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1006	CWE-22	Path Traversal	predictive	Hög
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Hög
3	TXXXX	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
5	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
7	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
9	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Hög

IOA - Indicator of Attack (22)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/data/nvram	predictive	Medium
2	File	categorie.php3	predictive	Hög
3	File	cgi-bin/	predictive	Medium
4	File	xxxxxx/xxx.x	predictive	Medium
5	File	xxx.xxxxxxx.xxxxxxxxxxxxxx?xxxxx=xxxxx&xxxxx=&xxxxxxxxx=xxxxxxxxx	predictive	Hög
6	File	xxxxxxxx.xxx	predictive	Medium
7	File	xxxxxxx.xxx	predictive	Medium
8	File	xxx/xxxx/xxx/xxxxx_xxxx.x	predictive	Hög
9	File	xxxxxxxx.xxx	predictive	Medium
10	File	xxxxxxx.xxx	predictive	Medium
11	File	xxxxxxxxxxx.xxx	predictive	Hög
12	File	xxxxxxxxxxxxxx.xxx	predictive	Hög
13	Argument	xxx	predictive	Låg
14	Argument	xxx	predictive	Låg
15	Argument	xxxxxxxxx	predictive	Medium
16	Argument	xxxxxxx xxxx	predictive	Medium
17	Argument	xxxxxx	predictive	Låg
18	Argument	xxx	predictive	Låg
19	Argument	xxxxxx	predictive	Låg
20	Input Value	../	predictive	Låg
21	Input Value	{{ }}	predictive	Låg
22	Network Port	xxxxxxxxxxxxxx xxxxxx	predictive	Hög

Referenser (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!