Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

gestioip-docker-compose

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.

CVE-2024-50861 identifies a stored cross-site scripting (XSS) vulnerability in GestioIP version 3.5.7, specifically within the ip_mod_dns_key_form.cgi request handler. The vulnerability arises because the application fails to properly sanitize or encode user input submitted to the "TSIG Key" field. This field's content is stored persistently in the backend database and rendered in the user interface without adequate output encoding, allowing malicious JavaScript payloads to execute in the context of authenticated users who view the affected page. The attack vector is remote and does not require authentication (AV:N, PR:N), but user interaction is necessary to trigger the payload (UI:R). The vulnerability impacts confidentiality and integrity by enabling data exfiltration and CSRF attacks, as attackers can steal session tokens or perform unauthorized actions on behalf of users. The scope is changed (S:C) because the vulnerability affects data beyond the attacker’s privileges, potentially impacting other users. The CVSS 3.1 base score is 6.1, reflecting medium severity. There are no known public exploits or patches available at the time of publication, increasing the urgency for organizations to implement mitigations. The vulnerability is classified under CWE-79, a common and well-understood web application security issue.

Detailed information about CVE-2024-50861: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-50861: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-50861: n/a

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.

CVE-2024-50858 is a Cross-Site Request Forgery (CSRF) vulnerability identified in GestioIP version 3.5.7, an open-source IP address management (IPAM) tool. CSRF vulnerabilities occur when a web application does not properly verify that requests made to sensitive endpoints originate from legitimate users, allowing attackers to trick authenticated users into submitting unwanted actions. In this case, multiple endpoints in GestioIP lack adequate CSRF protections, enabling an attacker to craft malicious URLs or web pages that, when visited by an admin user, execute unauthorized commands. These actions can include modifying, deleting, or exfiltrating critical IP address data managed by GestioIP. The vulnerability does not require the attacker to have prior authentication or elevated privileges; however, it does require the victim to be logged in and interact with the malicious content. The CVSS v3.1 base score of 8.8 reflects the high impact on confidentiality, integrity, and availability, combined with the network attack vector and low attack complexity. Although no public exploits have been reported yet, the vulnerability poses a significant risk due to the sensitive nature of IPAM data and the potential for administrative control compromise. The lack of available patches at the time of disclosure necessitates immediate attention from administrators to implement compensating controls.

Detailed information about CVE-2024-50858: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-50858: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-50858: n/a

The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully.

CVE-2024-50857 identifies a Cross-Site Scripting (XSS) vulnerability within the ip_do_job request handler of GestioIP version 3.5.7, a network IP address management tool. The vulnerability stems from insufficient sanitization of user-supplied input, allowing malicious scripts to be injected and executed in the context of authenticated users. Successful exploitation requires the attacker to have specific user permissions within the application and involves user interaction, such as clicking a crafted link or submitting malicious input. The XSS flaw enables attackers to exfiltrate sensitive data accessible to the victim, including session tokens or other credentials, and facilitates Cross-Site Request Forgery (CSRF) attacks by leveraging the victim's authenticated session. The vulnerability affects confidentiality and integrity but does not impact system availability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, high privileges required, user interaction needed, and a scope change due to potential session hijacking or privilege escalation within the application context. No public exploits or patches are currently available, indicating the need for proactive mitigation by administrators.

Detailed information about CVE-2024-50857: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2024-50861: n/aCVE-2024-50861 0 The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-50861 Join the discussion	CVE Database V5	01/14/2025, 00:00:00 UTC Added: 02/25/2026, 21:37:38 UTC
CVE-2024-50858: n/aCVE-2024-50858 0 Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-50858 Join the discussion	CVE Database V5	01/14/2025, 00:00:00 UTC Added: 02/25/2026, 21:37:38 UTC
CVE-2024-50857: n/aCVE-2024-50857 0 The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-50857 Join the discussion	CVE Database V5	01/14/2025, 00:00:00 UTC Added: 02/25/2026, 21:37:38 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional