Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A command injection vulnerability (CVE-2024-2947) exists in the Cockpit web-based server administration tool used in Red Hat Enterprise Linux 9. The issue occurs when deleting a sosreport with a crafted name, allowing potential command injection. Red Hat has released a security update to address this vulnerability. The severity is rated as moderate by Red Hat Product Security.

CVE-2024-2947 is a command injection vulnerability in the Cockpit tool for administering GNU/Linux servers via a web browser. Specifically, the flaw arises when deleting a sosreport that has a specially crafted name, which can lead to command injection (CWE-77). This vulnerability affects Red Hat Enterprise Linux 9 across multiple architectures and variants. Red Hat has issued a security advisory (RHSA-2024:3843) and released updated packages to fix this issue.

Detailed information about Red Hat Security Advisory: cockpit security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical detai

Red Hat Security Advisory: cockpit security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2024:3843

https://access.redhat.com/security/updates/classification/#moderate

2271614

Canonical URL

Red Hat Security Advisory: cockpit security update

cockpit

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

CVE-2024-2947 is a command injection vulnerability identified in Cockpit, an open-source web-based server management interface widely used for Linux system administration. The vulnerability exists in Cockpit versions 270 and newer and is triggered when a user attempts to delete a sosreport—a diagnostic archive—with a specially crafted filename via the Cockpit web interface. The flaw stems from improper neutralization of special elements in the sosreport name, allowing malicious input to be interpreted as shell commands. This leads to command injection, enabling an attacker to execute arbitrary commands with the privileges of the Cockpit process. Given that Cockpit typically runs with elevated privileges, successful exploitation can result in privilege escalation, compromising system confidentiality, integrity, and availability. The vulnerability requires local access with some privileges (as indicated by the CVSS vector AV:L/PR:L/UI:R), and user interaction is necessary to trigger the flaw. Although no known exploits have been reported in the wild, the high CVSS score (7.3) reflects the significant risk posed by this vulnerability. The issue highlights the critical importance of proper input validation and sanitization in web interfaces that interact with system commands. Since Cockpit is commonly deployed on Linux servers for system management, this vulnerability can impact a broad range of organizations relying on it for operational tasks.

Detailed information about CVE-2024-2947: Improper Neutralization of Special Elements used in a Command ('Command Injection'). Get real-time updates, technical 

CVE-2024-2947: Improper Neutralization of Special Elements used in a Command ('Command Injection') - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-2947: Improper Neutralization of Special Elements used in a Command ('Command Injection')


Red Hat Security Advisory: cockpit security updateCVE-2024-2947 0 A command injection vulnerability (CVE-2024-2947) exists in the Cockpit web-based server administration tool used in Red Hat Enterprise Linux 9. The issue occurs when deleting a sosreport with a crafted name, allowing potential command injection. Red Hat has released a security update to address this vulnerability. The severity is rated as moderate by Red Hat Product Security. MediumVulnerability#gcve #csaf #cve-2024-2947 Join the discussion	GCVE Database	06/11/2024, 19:38:37 UTC Added: 06/02/2026, 21:44:02 UTC
CVE-2024-2947: Improper Neutralization of Special Elements used in a Command ('Command Injection')CVE-2024-2947 0 A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer. HighVulnerabilityUnited StatesGermanyUnited Kingdom+9#cve #cve-2024-2947 Join the discussion	CVE Database V5	03/28/2024, 18:31:59 UTC Added: 11/20/2025, 19:18:29 UTC

Threats Tagged 'cve-2024-2947'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-2947'

Lead Pen Test Professional