Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.

CVE-2020-27298 is an OS command injection vulnerability identified in multiple versions of Philips Interventional Workspot software (Releases 1.3.2, 1.4.0, 1.4.1, 1.4.3, and 1.4.5), as well as related Philips products such as Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0) and ViewForum (Release 6.3V1L10). The vulnerability arises because the software constructs operating system commands using input that originates from upstream components without properly sanitizing or neutralizing special characters that could alter the intended command. This improper input validation allows an attacker to inject arbitrary OS commands that the system executes, potentially leading to denial of service or other disruptions. The CVSS v3.1 base score is 6.5, indicating a medium severity level. The vector string (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) shows that the attack requires adjacent network access (AV:A), has low attack complexity (AC:L), requires no privileges (PR:N), no user interaction (UI:N), and impacts availability only (A:H) without affecting confidentiality or integrity. No known exploits have been reported in the wild to date. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a common and critical injection weakness. The affected software is used in clinical environments for interventional cardiology procedures, meaning the systems are critical for patient care workflows. Exploitation could disrupt availability of these systems, potentially delaying or interrupting medical procedures. The lack of patches or mitigations published alongside this CVE suggests that organizations must rely on compensating controls until official fixes are available.

Detailed information about CVE-2020-27298: CWE-78 OS Command Injection in Philips Interventional Workspot affecting Philips Interventional Workspot. Get real-ti

CVE-2020-27298: CWE-78 OS Command Injection in Philips Interventional Workspot - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2020-27298: CWE-78 OS Command Injection in Philips Interventional Workspot

Threats Tagged 'cve-2020-27298'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2020-27298'

Lead Pen Test Professional