Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

CVE-2022-0029 is a vulnerability classified under CWE-59 (Improper Link Resolution Before File Access, also known as 'Link Following') affecting the Palo Alto Networks Cortex XDR Agent on Windows devices. This vulnerability arises when the agent improperly resolves symbolic links during the process of generating a technical support file. Specifically, a local attacker with limited privileges can exploit this flaw to read arbitrary files on the system with elevated privileges. The vulnerability affects multiple versions of the Cortex XDR Agent, including versions 7.7, 7.5 CE, and 5.0. The issue is due to the agent not correctly validating or restricting the resolution of symbolic links, allowing an attacker to manipulate the file path to access sensitive files outside the intended scope. The CVSS v3.1 base score is 5.5, indicating a medium severity level. The vector string (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) shows that the attack requires local access with low complexity, low privileges, no user interaction, and results in high confidentiality impact but no integrity or availability impact. No known exploits are reported in the wild, and no patches are explicitly linked in the provided data, though it is likely that Palo Alto Networks has addressed this in subsequent updates. This vulnerability is significant because Cortex XDR Agent is a widely deployed endpoint detection and response tool, and unauthorized file access could lead to exposure of sensitive system or user data, potentially aiding further attacks or data breaches.

Detailed information about CVE-2022-0029: CWE-59 Improper Link Resolution Before File Access ('Link Following') in Palo Alto Networks Cortex XDR Agent affecting

CVE-2022-0029: CWE-59 Improper Link Resolution Before File Access ('Link Following') in Palo Alto Networks Cortex XDR Agent - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-0029: CWE-59 Improper Link Resolution Before File Access ('Link Following') in Palo Alto Networks Cortex XDR Agent

Threats Tagged 'cve-2022-0029'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2022-0029'

Lead Pen Test Professional