Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Güralp FMUS series seismic monitoring devices expose an unauthenticated Telnet-based command line interface that 
could allow an attacker to modify hardware configurations, manipulate 
data, or factory reset the device.

CVE-2025-8286 is a critical vulnerability affecting all versions of the Güralp FMUS Series seismic monitoring devices. These devices are used for seismic data collection and monitoring, often deployed in geologically sensitive areas to detect and analyze seismic activity. The vulnerability arises from an unauthenticated Telnet-based command line interface exposed by the devices. Telnet, being an unencrypted protocol, combined with the lack of authentication, allows any attacker with network access to the device to connect to the command line interface without credentials. This access enables the attacker to perform several malicious actions, including modifying hardware configurations, manipulating seismic data, or performing a factory reset of the device. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that critical functions are accessible without proper authentication controls. The CVSS v3.1 base score is 9.8, reflecting the high impact on confidentiality, integrity, and availability, ease of exploitation (no authentication or user interaction required), and network attack vector. Although no known exploits have been reported in the wild yet, the severity and simplicity of exploitation make this a significant threat. The lack of available patches at the time of publication further exacerbates the risk. Given the role of these devices in monitoring seismic activity, any compromise could lead to falsified or lost seismic data, potentially impacting early warning systems, scientific research, and infrastructure safety decisions.

Detailed information about CVE-2025-8286: CWE-306 in Güralp Systems Güralp FMUS Series Seismic Monitoring Devices affecting Güralp Systems Güralp FMUS Series Se

CVE-2025-8286: CWE-306 in Güralp Systems Güralp FMUS Series Seismic Monitoring Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-8286: CWE-306 in Güralp Systems Güralp FMUS Series Seismic Monitoring Devices

Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass.This issue affects ATA-AOF Mobile Application: before 20.06.2025.

CVE-2025-4378 is a critical vulnerability identified in the ATA-AOF Mobile Application developed by Ataturk University. This vulnerability involves two primary weaknesses: cleartext transmission of sensitive information (CWE-319) and the use of hard-coded credentials (CWE-798). The cleartext transmission flaw means that sensitive data such as authentication tokens, user credentials, or personal information is sent over the network without encryption, making it susceptible to interception by attackers performing man-in-the-middle (MITM) attacks or network sniffing. The presence of hard-coded credentials further exacerbates the risk by allowing attackers to bypass authentication mechanisms or abuse authentication processes, potentially gaining unauthorized access to user accounts or administrative functions within the application. The vulnerability affects all versions of the ATA-AOF Mobile Application prior to version 20.06.2025 and does not require any user interaction or prior authentication to exploit. The CVSS v3.1 score of 10.0 reflects the highest severity, indicating that exploitation can lead to complete compromise of confidentiality and integrity, with some impact on availability. The scope of the vulnerability is changed (S:C), meaning exploitation can affect resources beyond the initially vulnerable component. Although no known exploits are currently reported in the wild, the combination of these weaknesses presents a significant risk to users of the application, particularly in environments where sensitive academic or personal data is handled. The vulnerability was published on June 24, 2025, and assigned by TR-CERT, highlighting its recognition within the Turkish cybersecurity community.

Detailed information about CVE-2025-4378: CWE-319 Cleartext Transmission of Sensitive Information in Ataturk University ATA-AOF Mobile Application affecting Ata

CVE-2025-4378: CWE-319 Cleartext Transmission of Sensitive Information in Ataturk University ATA-AOF Mobile Application - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4378: CWE-319 Cleartext Transmission of Sensitive Information in Ataturk University ATA-AOF Mobile Application

Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass.This issue affects Wi-Fi Cloud Hotspot: before 30.05.2025.

CVE-2025-4383 is a critical vulnerability identified in the Wi-Fi Cloud Hotspot product developed by Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. This vulnerability stems from CWE-307, which concerns improper restriction of excessive authentication attempts. Specifically, the affected versions of Wi-Fi Cloud Hotspot (all versions prior to 30.05.2025) do not adequately limit the number of authentication attempts, allowing an attacker to perform brute force or automated authentication abuse without being blocked or throttled. The vulnerability enables authentication bypass and abuse, potentially allowing attackers to gain unauthorized access to the hotspot management interface or user sessions. The CVSS v3.1 base score is 9.3 (critical), reflecting the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change (S:C), no confidentiality impact (C:N), low integrity impact (I:L), and high availability impact (A:H). The scope change indicates that the vulnerability affects components beyond the initially vulnerable system, potentially impacting connected systems or services. The high availability impact suggests that exploitation could lead to denial of service or disruption of hotspot services. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability was published on June 24, 2025, with the reservation date on May 6, 2025, by TR-CERT, indicating a Turkish origin of the vendor and initial reporting. The Wi-Fi Cloud Hotspot product is typically used to provide managed wireless internet access in public or semi-public environments, such as cafes, hotels, airports, and other venues requiring controlled Wi-Fi access. The lack of restriction on authentication attempts means attackers can systematically try credentials or session tokens to gain unauthorized access or disrupt service availability.

Detailed information about CVE-2025-4383: CWE-307 Improper Restriction of Excessive Authentication Attempts in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic

CVE-2025-4383: CWE-307 Improper Restriction of Excessive Authentication Attempts in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4383: CWE-307 Improper Restriction of Excessive Authentication Attempts in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot

This article explores a new obfuscation technique used by threat actors to conceal malware within bitmap resources embedded in benign 32-bit .NET applications. The malware executes through a multi-stage process of extracting, deobfuscating, loading, and executing secondary payloads. The analysis focuses on a sample from recent malspam campaigns targeting financial organizations in Turkey and logistics sectors in Asia. The malware uses steganography to hide its payloads, making it challenging to detect. The article details the technical analysis of each stage, from the initial payload to the final execution of malware families like Agent Tesla, XLoader, and Remcos RAT. It also provides guidance on how to overcome this obfuscation technique using debugging methods.

This threat involves a sophisticated malware obfuscation technique targeting 32-bit .NET applications by embedding malicious payloads within bitmap resources. The malware is delivered primarily through malspam campaigns and uses steganography to conceal secondary payloads inside seemingly benign bitmap images embedded as resources in legitimate .NET executables. Upon execution, the initial payload extracts these bitmap resources, deobfuscates the hidden data, and dynamically loads and executes secondary malware families such as Agent Tesla, XLoader, and Remcos RAT. These malware families are known for credential theft, remote access capabilities, and information exfiltration. The multi-stage execution chain complicates detection and analysis, as the malicious code is not directly visible in the executable but hidden within image data, evading traditional signature-based detection. The malware also employs various obfuscation and anti-debugging techniques, making static and dynamic analysis challenging. The threat actors behind these campaigns have targeted financial organizations in Turkey and logistics sectors in Asia, indicating a focus on high-value industries with sensitive data. The use of .NET as a platform leverages its widespread adoption in enterprise environments, and the embedding of payloads in bitmap resources is a novel evasion technique that bypasses many conventional security controls. The article referenced provides detailed technical breakdowns of each stage, including debugging methods to overcome the obfuscation and detect the hidden payloads.

Detailed information about Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources. Get real-time updates, technical details, and mitigation strate

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources - Live Threat Intelligence - Threat Radar | OffSeq.com

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

A new wave of Mirai botnet attacks is exploiting CVE-2024-3721 to target TBK DVR devices. The campaign uses a POST request to execute system commands without authorization, downloading and running an ARM32 binary. This Mirai variant includes features like RC4 string encryption, anti-VM checks, and anti-emulation techniques. The malware verifies if it's running in a virtual environment and checks for allowed directories. Infected devices are primarily located in China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. Over 50,000 exposed DVR devices are potentially vulnerable. The botnet's main goal is to conduct DDoS attacks. Updating vulnerable devices and performing factory resets are recommended as protective measures.

The threat described involves a new wave of attacks by a Mirai botnet variant exploiting a recently disclosed vulnerability identified as CVE-2024-3721. This vulnerability affects TBK brand Digital Video Recorder (DVR) devices, which are commonly used in surveillance and security camera systems. The exploitation method involves sending a specially crafted POST request that allows unauthenticated attackers to execute arbitrary system commands on the targeted device. Upon successful exploitation, the attacker downloads and executes an ARM32 binary payload, which is a variant of the Mirai malware. This variant incorporates advanced evasion techniques such as RC4 string encryption to obfuscate its code and communications, anti-virtual machine (VM) checks, and anti-emulation methods to avoid detection and analysis in sandboxed or virtualized environments. The malware also verifies that it is running in allowed directories before proceeding, which further complicates forensic analysis and detection. The primary objective of this botnet is to conscript vulnerable DVR devices into a large-scale distributed denial-of-service (DDoS) botnet, leveraging their network connectivity and processing power to overwhelm targeted systems or networks. The campaign has identified over 50,000 exposed TBK DVR devices as potentially vulnerable, with infections primarily reported in countries including China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. Although the campaign is currently not reported to have active exploits in the wild beyond initial observations, the scale of vulnerable devices and the sophistication of the malware indicate a significant threat vector. The lack of available patches or firmware updates for these devices exacerbates the risk, making mitigation reliant on device resets and network-level protections. The technical sophistication of the malware, combined with the critical role of DVR devices in security infrastructure, underscores the importance of addressing this vulnerability promptly.

Detailed information about Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721. Get real-time updates, technical details, and mitiga

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721 - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721

A new Android banking Trojan, Crocodilus, has rapidly evolved since its discovery in March 2025. Initially targeting Turkey, it has expanded to European countries and South America. The malware is distributed through malicious advertising on social networks, masquerading as banking and e-commerce apps. Recent developments include improved obfuscation techniques, the ability to add contacts to the victim's device, and an enhanced seed phrase collector for cryptocurrency wallets. Campaigns have been observed targeting users in Poland, Spain, and multiple global locations. The malware's sophistication and expanding reach indicate a well-organized threat actor, posing an increasing risk to users and organizations worldwide.

Crocodilus is a recently identified Android banking Trojan first discovered in March 2025. Initially targeting users in Turkey, it has rapidly expanded its reach to European countries such as Poland and Spain, as well as regions in South America. The malware is primarily distributed via malvertising campaigns on social networks, where it masquerades as legitimate banking and e-commerce applications to deceive users into installing it. Technically, Crocodilus employs advanced obfuscation techniques (MITRE ATT&CK T1027 and T1027.002) to evade detection by security solutions, making it difficult to identify and remove. It has evolved to include capabilities such as adding contacts to the victim's device, which can facilitate further social engineering or propagation within a victim's network. Additionally, it features an enhanced seed phrase collector designed to steal cryptocurrency wallet credentials, significantly increasing the potential financial impact on victims. The malware targets both traditional banking credentials and cryptocurrency assets, indicating a dual-purpose threat. Indicators of compromise include specific file hashes and malicious domains (rentvillcr.homes, rentvillcr.online) linked to its infrastructure. The campaign's rapid expansion and technical sophistication suggest a well-resourced and organized threat actor capable of maintaining and evolving the malware quickly, posing a growing risk to users and organizations relying on Android devices for financial transactions and cryptocurrency management.

Detailed information about Crocodilus Mobile Malware: Evolving Fast, Going Global. Get real-time updates, technical details, and mitigation strategies.

Crocodilus Mobile Malware: Evolving Fast, Going Global - Live Threat Intelligence - Threat Radar | OffSeq.com

Crocodilus Mobile Malware: Evolving Fast, Going Global

The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25

CVE-2022-2265 is a high-severity unauthenticated path traversal vulnerability (CWE-35) affecting the Identity and Directory Management System developed by Çekino Bilgi Teknolojileri prior to version 2.1.25. Path traversal vulnerabilities allow an attacker to manipulate file path inputs to access files and directories outside the intended scope of the application. In this case, the vulnerability arises from improper validation or sanitization of file path parameters, enabling an attacker to use sequences such as '.../...//' to traverse directories on the server filesystem. Since the vulnerability is unauthenticated, no credentials or user interaction are required to exploit it, increasing the risk. The CVSS 3.1 base score of 7.5 reflects the network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N, A:N). Exploiting this vulnerability could allow an attacker to read sensitive files on the server, including configuration files, credentials, or other protected data, potentially leading to information disclosure. The vendor has addressed this issue in version 2.1.25, and users of earlier versions are advised to upgrade. There are no known exploits in the wild reported to date. The vulnerability was published on September 21, 2022, and assigned by TR-CERT. The affected versions are unspecified but are all versions prior to 2.1.25. The vulnerability specifically impacts the Çekino Bilgi Teknolojileri Identity and Directory Management System, which is likely deployed in environments requiring identity management and directory services.

Detailed information about CVE-2022-2265: CWE-35 Path Traversal: '.../...//' in Çekino Bilgi Teknolojileri Çekino Bilgi Teknolojileri affecting Çekino Bilgi Tek

CVE-2022-2265: CWE-35 Path Traversal: '.../...//' in Çekino Bilgi Teknolojileri Çekino Bilgi Teknolojileri - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-2265: CWE-35 Path Traversal: '.../...//' in Çekino Bilgi Teknolojileri Çekino Bilgi Teknolojileri

University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2

CVE-2022-2266 is a reflected Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting the University Library Automation System developed by Yordam Bilgi Teknolojileri. This vulnerability exists in versions prior to 19.2 and allows an unauthenticated attacker to inject malicious scripts into web pages generated by the system. Reflected XSS occurs when user-supplied input is improperly neutralized and then immediately reflected back in the HTTP response, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser. The vulnerability requires no authentication but does require user interaction, such as clicking a crafted URL. The CVSS v3.1 base score is 6.1 (medium severity), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability. The vulnerability has been fixed in version 19.2 of the product. No known exploits in the wild have been reported. The vulnerability could be leveraged to steal session cookies, perform actions on behalf of the user, or redirect users to malicious sites, potentially compromising user data and trust in the affected system.

Detailed information about CVE-2022-2266: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Yordam Bilgi Teknolojil

CVE-2022-2266: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Yordam Bilgi Teknolojileri Yordam Bilgi Teknolojileri - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-2266: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Yordam Bilgi Teknolojileri Yordam Bilgi Teknolojileri

SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection.This issue affects Prens Student Information System: before 2.1.11.

CVE-2022-2807 is an SQL Injection vulnerability identified in the Algan Software Prens Student Information System, specifically affecting versions prior to 2.1.11. SQL Injection (CWE-89) occurs when user-supplied input is improperly neutralized before being included in SQL queries, allowing an attacker to manipulate the backend database queries. This vulnerability enables an attacker to inject malicious SQL code into the system, potentially leading to unauthorized data access, data modification, or even complete compromise of the database. The Prens Student Information System is used to manage student information, which typically includes sensitive data such as personal identification details, academic records, and possibly financial information. The vulnerability arises from insufficient input validation or sanitization in the application’s database query construction, allowing special SQL elements to be executed. Although no known exploits are currently reported in the wild, the presence of this vulnerability in an educational management system poses a significant risk due to the sensitivity of the data involved and the potential for exploitation by attackers seeking to access or manipulate student records. The lack of available patches at the time of reporting further increases the urgency for affected organizations to implement mitigations. Given that the vulnerability does not require authentication or user interaction to be exploited, it can be triggered remotely by an attacker sending crafted input to the system’s interface that interacts with the database.

Detailed information about CVE-2022-2807: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Algan Software Prens St

CVE-2022-2807: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Algan Software Prens Student Information System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-2807: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Algan Software Prens Student Information System

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP allows an authenticated user to execute Stored XSS.

This issue affects LioXERP: before v.146.

CVE-2023-5989 is a Stored Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting the LioXERP product developed by Uyumsoft Information System and Technologies. This vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated user to inject malicious scripts that are stored and subsequently executed in the context of other users' browsers. Specifically, the flaw exists in versions of LioXERP prior to version 146. Since exploitation requires authentication, an attacker must have valid credentials to the system to leverage this vulnerability. Once exploited, the malicious script can execute arbitrary JavaScript code within the victim's browser session, potentially leading to session hijacking, unauthorized actions on behalf of the user, data theft, or the spread of malware. The absence of a patch or update link suggests that remediation may not yet be publicly available, increasing the urgency for organizations to implement compensating controls. No known exploits have been reported in the wild as of the published date (December 21, 2023), but the presence of this vulnerability in an enterprise resource planning (ERP) system, which typically handles sensitive business data and workflows, elevates the risk profile. The vulnerability was reserved by TR-CERT and enriched by CISA, indicating recognition by multiple cybersecurity authorities.

Detailed information about CVE-2023-5989: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Uyumsoft Information Sy

CVE-2023-5989: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Uyumsoft Information System and Technologies LioXERP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-5989: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Uyumsoft Information System and Technologies LioXERP

Title	Severity	Type	Source	Date

Threats Affecting Turkey

Filter Threats

Threats Affecting Turkey

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility