Vulnerabilitymedium
The Disdain exploit kit appears in the threat landscape
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-2551 | Use-After-Free RCE in Microsoft Internet Explorer | — | 74% | KEVRansomware | — KEV |
| CVE-2014-6332 | Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation | — | 95% | KEV | — KEV |
| CVE-2015-2419 | Memory Corruption RCE in Microsoft Internet Explorer JScript Engine | — | 53% | KEV | — KEV |
| CVE-2015-5119 | Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray) | — | 99% | KEV | — KEV |
| CVE-2016-0189 | Memory Corruption RCE in Microsoft IE Scripting Engines (JScript/VBScript) | 7.5 | 94% | KEVRansomwarePoC | KEV |
| CVE-2016-1019 | Arbitrary code execution flaw in Adobe Flash Player, used in ransomware attacks | 9.8 | 22% | KEVRansomware | KEV |
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier | 9.8 | 94% | KEVRansomwarePoC | KEV |
| CVE-2016-7200 | Memory Corruption RCE in Microsoft Edge Chakra JavaScript Engine (CVE-2016-7200) | 8.8 | 83% | KEVPoC ×3 | KEV |
| CVE-2016-9078 | Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances | 8.8 | 2% | PoC | |
| CVE-2017-0037 | Type Confusion RCE in Microsoft Internet Explorer and Edge | 8.1 | 80% | KEVPoC ×5 | KEV |
| CVE-2017-3823 | An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the… | 8.8 | 27% | ||
| CVE-2017-5375 | JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks | 9.8 | 34% | PoC ×3 |
From the original article
2 min read at securityaffairs.comThe Disdain exploit kit is available for rent on a daily, weekly, or monthly basis for prices of $80, $500, and $1,400 respectively. The security researcher David Montenegro discovered a new exploit kit dubbed Disdain that is offered for rent on underground hacking forums by a malware developer using the pseudonym of Cehceny.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.