Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup name, and description (but not the password).

CVE-2020-8422 is a medium-severity authorization vulnerability identified in the Credential Manager feature of Zoho ManageEngine Remote Access Plus versions prior to 10.0.450. The flaw allows a user assigned the Guest role—typically a low-privilege account—to extract sensitive metadata related to stored credentials for remote machines managed by the platform. Specifically, the exposed information includes the credential name, credential type, associated user name, domain or workgroup name, and description. Notably, the actual passwords are not disclosed through this vulnerability. The root cause is an insufficient authorization check that fails to restrict Guest users from accessing the collection of defined credentials. The vulnerability does not require user interaction and can be exploited remotely without authentication complexity beyond possessing a Guest role account. The CVSS v3.0 base score is 4.3, reflecting a low attack complexity, network attack vector, and limited confidentiality impact without affecting integrity or availability. There are no known public exploits in the wild, and no patches or vendor advisories are explicitly linked in the provided data. This vulnerability could be leveraged by an attacker with Guest access to gather credential metadata, which could facilitate further targeted attacks such as social engineering or privilege escalation if combined with other vulnerabilities or misconfigurations.

Detailed information about CVE-2020-8422: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2020-8422: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2020-8422: n/a in n/a

Threats Tagged 'cve-2020-8422'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2020-8422'

Lead Pen Test Professional