Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

CVE-2019-3844 is a medium-severity local privilege escalation vulnerability found in systemd version 242, a widely used system and service manager for Linux operating systems, maintained by freedesktop.org. The vulnerability arises from improper handling of the DynamicUser property in systemd service units. Specifically, when a service uses the DynamicUser feature, it creates transient user and group IDs dynamically for the service's runtime. The flaw allows a local attacker to exploit the execution of SUID (Set User ID) binaries to create files or binaries owned by the service's transient group with the setgid bit set. Because group IDs (GIDs) are recycled over time, an attacker can leverage this to gain access to resources that may later be owned by a different service, effectively escalating privileges by accessing or manipulating resources under another service's group context. This vulnerability is classified under CWE-268 (Improper Privilege Management), indicating that the system does not adequately restrict privilege escalation paths. Exploitation requires local access with low privileges and does not require user interaction, but it does require a high level of attack complexity due to the need to manipulate SUID binaries and group ID recycling behavior. The CVSS v3.0 base score is 4.5, reflecting a medium severity with limited confidentiality, integrity, and availability impacts. No known public exploits have been reported in the wild, and no official patches are linked in the provided data, though systemd maintainers have likely addressed this in subsequent releases after version 242.

Detailed information about CVE-2019-3844: CWE-268 in [freedesktop.org] systemd affecting [freedesktop.org] systemd. Get real-time updates, technical details, an

CVE-2019-3844: CWE-268 in [freedesktop.org] systemd - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2019-3844: CWE-268 in [freedesktop.org] systemd

Threats Tagged 'cve-2019-3844'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2019-3844'

Lead Pen Test Professional