CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Cobalt Strike Remote Code Execution Vulnerability via Swing Component HTML Injection (CVE-2022-42948)
[Affected Scope] Cobalt Strike version 4.7.1
[Impact] Remote attackers can execute arbitrary code within the Cobalt Strike UI context by injecting crafted HTML payloads
[Mitigation] Immediately upgrade to Cobalt Strike version 4.7.2 or later, and restrict access to the Teamserver
Cobalt Strike Teamserver Remote Cross-Site Scripting (XSS) Vulnerability (CVE-2022-39197) Security Advisory
[Affected Scope] HelpSystems Cobalt Strike through version 4.7 (specifically affecting the Teamserver component)
[Impact] A remote attacker can execute arbitrary HTML/JS code within the Cobalt Strike operator console by spoofing the username field in a beacon payload, potentially leading to session hijacking or information disclosure
[Mitigation] Immediately upgrade Cobalt Strike to the official patched version 4.7.1 or higher