Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".

CVE-2018-1000500 is a vulnerability identified in BusyBox's wget applet, where there is missing SSL certificate validation when downloading files over HTTPS. BusyBox is a widely used software suite that provides several Unix utilities in a single executable, commonly deployed in embedded systems, IoT devices, routers, and lightweight Linux distributions. The wget applet is used to download files from the internet, and the lack of proper SSL certificate validation means that an attacker can perform man-in-the-middle (MITM) attacks by intercepting HTTPS traffic and serving malicious files without detection. This vulnerability allows an attacker to trick the wget applet into downloading and executing arbitrary code from a compromised or malicious domain. The attack vector involves simply invoking "busybox wget https://compromised-domain.com/important-file" to download a malicious payload. The CVSS score is 6.5 (medium severity), with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity but not availability. The weakness corresponds to CWE-295, which relates to improper certificate validation. Although no known exploits in the wild have been reported, the vulnerability poses a significant risk in environments where BusyBox wget is used to fetch files from untrusted or potentially compromised sources over HTTPS without additional verification. The lack of patch links suggests that remediation may require upgrading BusyBox versions or applying custom patches to enforce proper SSL certificate validation.

Detailed information about CVE-2018-1000500: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2018-1000500: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2018-1000500: n/a in n/a

Threats Tagged 'cve-2018-1000500'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2018-1000500'

Lead Pen Test Professional