Advisory further TTPs associated with SVR cyber actors

ncsc.gov.uk · Undated · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

15 CVEs

CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote Services T1059Command and Scripting Interpreter+2 more · 6 reports
>99.9%Top 0.01%
90.0priority
CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application5 reports
>99.9%Top 0.01%
89.9priority
CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1059Command and Scripting Interpreter+1 more · 8 reports
>99.9%Top 0.01%
89.9priority
CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1190Exploit Public-Facing Application+5 more · 5 reports
>99.9%Top 0.01%
89.9priority
CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote Services T1505.003Web Shell+2 more · 5 reports
>99.9%Top 0.01%
89.4priority
CVE-2019-2725Oracle WebLogic Server, Injection
Oracle · WebLogic ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter4 reports
>99.9%Top 0.02%
88.8priority
CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell4 reports
99.9%Top 0.04%
87.4priority
CVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell3 reports
95.8%Top 0.13%
86.2priority
CVE-2021-21972VMware vCenter Server Remote Code Execution Vulnerability
VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
99.9%Top 0.04%
83.7priority
CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwareHigh · 7.8T1505.003Web Shell3 reports
93.7%Top 0.16%
81.2priority
CVE-2019-9670Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1005Data from Local System2 reports
>99.9%Top 0.02%
76.0priority
CVE-2019-7609Kibana Arbitrary Code Execution
Elastic · KibanaKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
95.3%Top 0.13%
73.8priority
CVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
>99.9%Top 0.01%
73.7priority
CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
Cisco · Small Business RV320 and RV325 RoutersKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1082System Information Discovery+2 more · 1 report
99.9%Top 0.04%
72.1priority
CVE-2020-4006Multiple VMware Products Command Injection Vulnerability
VMware · Multiple ProductsKEVCritical · 9.1T1190Exploit Public-Facing Application1 report
17.3%Top 2.9%
67.7priority