Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory of the path, and Windows will resolve that executable instead of the intended executable.

CVE-2024-47856 is a critical vulnerability affecting RSA Authentication Agent versions prior to 7.4.7. The root cause is improper handling of service and shortcut paths that include spaces but lack surrounding quotation marks. Windows path resolution behavior can be exploited by an attacker who places a malicious executable in a directory higher in the path hierarchy than the legitimate executable. When the system attempts to execute the intended program, Windows resolves and runs the attacker's executable instead. This is a classic path interception attack, categorized under CWE-23 (Relative Path Traversal). The vulnerability allows an adversary with local access to escalate privileges or execute arbitrary code with the permissions of the affected service, potentially compromising system confidentiality, integrity, and availability. The CVSS v3.1 score of 9.8 reflects its critical nature: it requires no privileges, no user interaction, and can be exploited remotely if local access is obtained. Although no public exploits are known yet, the vulnerability's characteristics make it a prime target for attackers aiming to bypass authentication mechanisms or gain persistence on critical systems. The lack of patch links suggests that remediation may require upgrading to version 7.4.7 or later once available. Organizations should audit their RSA Authentication Agent deployments, verify path configurations, and monitor for suspicious executable placements in directories involved in service or shortcut paths.

Detailed information about CVE-2024-47856: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-47856: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-47856: n/a

Threats Tagged 'cve-2024-47856'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-47856'

Lead Pen Test Professional