Patchfirst
Patchfirst
T1204.001Execution

Malicious Link

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or…

attack.mitre.org ↗
CVEs61
In 38
Reports1

Detections

4 Sigma rules tagged T1204.001
Malicious LinkT1204.0014 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Malicious Link

61 CVEs, by priority. Each link shows its badge.
  1. CVE-2024-21412Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.1T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass1 report
    AI mapping from the description · how it is exploited
    99.4%Top 0.06%
    82.5priority
  2. CVE-2023-36025Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1211Exploitation for Stealth
    AI mapping from the description · how it is exploited
    88.1%Top 0.23%
    79.1priority
  3. CVE-2019-18426WhatsApp Cross-Site Scripting Vulnerability
    Meta Platforms · WhatsAppKEVPublic exploitHigh · 8.2T1204.001Malicious LinkT1059.007JavaScript+1 more
    AI mapping from the description · how it is exploited
    67.9%Top 0.68%
    78.6priority
  4. CVE-2010-2568Microsoft Windows Remote Code Execution Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1204.001Malicious LinkT1059Command and Scripting Interpreter4 reports
    AI mapping from the description · how it is exploited
    89.6%Top 0.21%
    77.4priority
  5. CVE-2020-3580Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
    Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVRansomwarePublic exploitMedium · 6.1T1204.001Malicious LinkT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    85.6%Top 0.28%
    77.2priority
  6. CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
    Synacor · Zimbra Collaborate Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    30.9%Top 1.7%
    76.9priority
  7. CVE-2008-4128Cisco IOS Cross-Site Request Forgery Vulnerability
    Cisco · IOSKEVPublic exploitHigh · 8.1T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    33.9%Top 1.6%
    73.3priority
  8. CVE-2026-96951Microsoft Windows Command Injection Vulnerability
    Microsoft · WindowsKEVHigh · 8.8T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    9.8%Top 4.5%
    73.3priority
  9. CVE-2025-68461RoundCube Webmail Cross-site Scripting Vulnerability
    Roundcube · WebmailKEVPublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript
    AI mapping from the description · how it is exploited
    27.4%Top 1.9%
    71.9priority
  10. CVE-2023-24880Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVRansomwareMedium · 4.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    AI mapping from the description · how it is exploited
    78.0%Top 0.43%
    71.0priority
  11. CVE-2017-8464Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1203Exploitation for Client Execution
    AI mapping from the description · how it is exploited
    90.0%Top 0.21%
    69.1priority
  12. CVE-2018-8414Microsoft Windows Shell Remote Code Execution Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    72.6%Top 0.56%
    69.0priority
  13. CVE-2019-0541Microsoft MSHTML Remote Code Execution Vulnerability
    Microsoft · MSHTMLKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    53.2%Top 1%
    69.0priority
  14. CVE-2023-5217Google Chromium libvpx Heap Buffer Overflow Vulnerability
    Google · Chromium libvpxKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1574Hijack Execution Flow
    MITRE CTID mapping of the KEV entry · how it is exploited
    49.0%Top 1.1%
    68.9priority
  15. CVE-2022-3038Google Chromium Network Service Use-After-Free Vulnerability
    Google · Chromium Network ServiceKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1574Hijack Execution Flow
    MITRE CTID mapping of the KEV entry · how it is exploited
    24.9%Top 2.1%
    68.7priority
  16. CVE-2025-6218RARLAB WinRAR Path Traversal Vulnerability
    RARLAB · WinRARKEVPublic exploitHigh · 7.8T1204.001Malicious Link
    AI mapping from the description · how it is exploited
    90.5%Top 0.2%
    68.4priority
  17. CVE-2014-100005D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
    D-Link · DIR-600 RouterKEVPublic exploitHigh · 8.0T1204.001Malicious LinkT1059Command and Scripting Interpreter+1 more
    AI mapping from the description · how it is exploited
    43.5%Top 1.3%
    68.3priority
  18. CVE-2016-0185Microsoft Windows Media Center Remote Code Execution Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1204.001Malicious LinkT1203Exploitation for Client Execution
    AI mapping from the description · how it is exploited
    69.8%Top 0.63%
    68.3priority
  19. CVE-2022-21971Microsoft Windows Runtime Remote Code Execution Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1204.001Malicious LinkT1059Command and Scripting Interpreter
    MITRE CTID mapping of the KEV entry · how it is exploited
    53.8%Top 1%
    68.3priority
  20. CVE-2024-38112Microsoft Windows MSHTML Platform Spoofing Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.5T1189Drive-by CompromiseT1204.001Malicious Link
    MITRE CTID mapping of the KEV entry · how it is exploited
    84.2%Top 0.3%
    68.2priority
  21. CVE-2020-11023JQuery Cross-Site Scripting (XSS) Vulnerability
    JQuery · JQueryKEVPublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    84.9%Top 0.29%
    67.2priority
  22. CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
    Roundcube · WebmailKEVPublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript
    AI mapping from the description · how it is exploited
    74.0%Top 0.52%
    67.2priority
  23. CVE-2023-37580Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript
    AI mapping from the description · how it is exploited
    49.1%Top 1.1%
    67.0priority
  24. CVE-2023-5631Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
    Roundcube · WebmailKEVPublic exploitMedium · 5.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    76.3%Top 0.46%
    66.7priority
  25. CVE-2021-38000Google Chromium Intents Improper Input Validation Vulnerability
    Google · Chromium IntentsKEVPublic exploitMedium · 6.1T1189Drive-by CompromiseT1204.001Malicious Link
    AI mapping from the description · primary impact
    4.9%Top 7.9%
    65.7priority
  26. CVE-2024-43461Microsoft Windows MSHTML Platform Spoofing Vulnerability
    Microsoft · WindowsKEVHigh · 8.8T1204.001Malicious Link
    AI mapping from the description · how it is exploited
    54.5%Top 0.99%
    64.0priority
  27. CVE-2023-35311Microsoft Outlook Security Feature Bypass Vulnerability
    Microsoft · OutlookKEVHigh · 8.8T1204.001Malicious LinkT1211Exploitation for Stealth
    AI mapping from the description · how it is exploited
    15.5%Top 3.2%
    63.5priority
  28. CVE-2022-3075Google Chromium Mojo Insufficient Data Validation Vulnerability
    Google · Chromium MojoKEVCritical · 9.6T1204.001Malicious Link
    MITRE CTID mapping of the KEV entry · how it is exploited
    5.8%Top 6.8%
    63.4priority
  29. CVE-2023-2136Google Chrome Skia Integer Overflow Vulnerability
    Google · Chromium SkiaKEVCritical · 9.6T1204.001Malicious Link
    MITRE CTID mapping of the KEV entry · how it is exploited
    5.8%Top 6.9%
    63.3priority
  30. CVE-2023-32046Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1204.001Malicious LinkT1068Exploitation for Privilege Escalation
    AI mapping from the description · how it is exploited
    10.0%Top 4.4%
    62.6priority
  31. CVE-2024-30040Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVHigh · 8.8T1204.001Malicious LinkT1211Exploitation for Stealth
    AI mapping from the description · how it is exploited
    3.9%Top 9.6%
    62.2priority
  32. CVE-2014-2120Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
    Cisco · Adaptive Security Appliance (ASA)KEVMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript
    AI mapping from the description · how it is exploited
    22.6%Top 2.3%
    61.8priority
  33. CVE-2023-41061Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
    Apple · iOS, iPadOS, and watchOSKEVHigh · 7.8T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    4.4%Top 8.7%
    61.7priority
  34. CVE-2020-9818Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
    Apple · iOS, iPadOS, and watchOSKEVHigh · 8.8T1204.001Malicious LinkT1499.004Application or System Exploitation
    AI mapping from the description · how it is exploited
    2.3%Top 16%
    60.9priority
  35. CVE-2023-36584Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVMedium · 5.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    AI mapping from the description · how it is exploited
    3.3%Top 12%
    59.4priority
  36. CVE-2022-41049Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVMedium · 5.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    AI mapping from the description · how it is exploited
    2.6%Top 14%
    58.9priority
  37. CVE-2020-9819Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
    Apple · iOS, iPadOS, and watchOSKEVMedium · 4.3T1204.001Malicious LinkT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    2.2%Top 17%
    57.6priority
  38. CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
    Adobe · Flash PlayerKEVEnd of lifeMedium · 6.1T1204.001Malicious LinkT1098Account Manipulation+2 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    6.2%Top 6.5%
    46.0priority
  39. CVE-2019-3708Cross-Site Scripting Vulnerability in OVA file upload feature
    Dell EMC · Dell EMC IsilonSD Management ServerHigh · 8.3T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    2.2%Top 17%
    22.4priority
  40. CVE-2019-16009Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
    Cisco · Cisco IOS 12.2(15)BHigh · 8.8T1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · how it is exploited
    1.0%Top 38%
    19.9priority
  41. CVE-2020-11082Cross-Site Scripting in Kaminari
    kaminari · KaminariMedium · 6.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.5%Top 25%
    19.5priority
  42. CVE-2020-15182Cross-site Request Forgery leading to RCE in SOY CMS
    inunosinsi · soycmsHigh · 8.4T1204.001Malicious LinkT1068Exploitation for Privilege Escalation
    MITRE CTID mapping of the CVE · how it is exploited
    1.2%Top 33%
    19.4priority
  43. CVE-2019-13511Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200
    T1204.001Malicious LinkT1005Data from Local System
    MITRE CTID mapping of the CVE · how it is exploited
    5.8%Top 6.9%
    18.6priority
  44. CVE-2019-1941Cisco Identity Services Engine Cross-Site Scripting Vulnerability
    Cisco · Cisco Identity Services Engine SoftwareMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.3%Top 30%
    18.2priority
  45. CVE-2019-1764Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability
    Cisco · Cisco Wireless IP Phone 8821 and 8821-EXHigh · 8.1T1204.001Malicious LinkT1068Exploitation for Privilege Escalation
    MITRE CTID mapping of the CVE · how it is exploited
    0.7%Top 47%
    17.7priority
  46. CVE-2018-15393Cisco Content Security Management Appliance (SMA) Cross-Site Scripting Vulnerability
    Cisco · Cisco Content Security Management Appliance (SMA)Medium · 4.8T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.2%Top 31%
    17.2priority
  47. CVE-2020-3121Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability
    Cisco · Cisco 550X Series Stackable Managed SwitchesMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.1%Top 35%
    17.2priority
  48. CVE-2020-12038Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx…
    T1204.001Malicious LinkT1499.004Application or System Exploitation
    MITRE CTID mapping of the CVE · how it is exploited
    2.6%Top 15%
    17.0priority
  49. CVE-2019-3754Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to…
    DELL EMC · Unity Operating EnvironmentMedium · 4.7T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.1%Top 34%
    16.5priority
  50. CVE-2019-1665Cisco Hyperflex Stored Cross-Site Scripting Vulnerability
    Cisco · Cisco HyperFlex HX-SeriesMedium · 4.7T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.1%Top 35%
    16.4priority
  51. CVE-2020-3137Cisco Email Security Appliance Cross-Site Scripting Vulnerability
    Cisco · Cisco Email Security Appliance (ESA)Medium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 42%
    15.8priority
  52. CVE-2020-3356Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability
    Cisco · Cisco Data Center Network ManagerMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 43%
    15.6priority
  53. CVE-2019-1857Cisco HyperFlex HX-Series Web-Based Management Interface Cross-Site Request Forgery Vulnerability
    Cisco · Cisco HyperFlex HX-SeriesMedium · 6.1T1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · how it is exploited
    0.6%Top 52%
    15.3priority
  54. CVE-2019-1838Cisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting Vulnerability
    Cisco · Cisco Application Policy Infrastructure Controller (APIC)Medium · 5.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 43%
    15.2priority
  55. CVE-2019-15994Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability
    Cisco · Cisco Stealthwatch EnterpriseMedium · 5.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 43%
    15.1priority
  56. CVE-2020-5269Reflected XSS on AdminFeatures page of PrestaShop
    PrestaShop · PrestaShopMedium · 4.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 43%
    14.2priority
  57. CVE-2020-5271Reflected XSS with dashboard calendar of PrestaShop
    PrestaShop · PrestaShopMedium · 4.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 43%
    14.2priority
  58. CVE-2020-5264Reflected XSS in security compromised page of PrestaShop
    PrestaShop · PrestaShopMedium · 4.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.8%Top 45%
    14.1priority
  59. CVE-2020-5336RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability
    Dell · RSA ArcherMedium · 4.6T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.7%Top 47%
    13.9priority
  60. CVE-2020-3349Cisco Data Center Network Manager Cross-Site Scripting Vulnerabilities
    Cisco · Cisco Data Center Network ManagerMedium · 4.8T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.6%Top 50%
    13.3priority
  61. CVE-2018-15401Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability
    Cisco · Cisco Hosted Collaboration Mediation FulfillmentT1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · how it is exploited
    0.5%Top 57%
    9.9priority

Passages that support these links

↑ ↓ chooseEnter openEsc close