In the ever-evolving landscape of cybersecurity threats, Microsoft SharePoint servers have become a prime target for sophisticated exploits. As of July 2025, a zero-day vulnerability chain dubbed "ToolShell" is being actively exploited. This vulnerability allows unauthenticated remote code execution (RCE) on on-premises SharePoint installations. It poses significant risks to organizations relying on SharePoint for collaboration and data management. In this technical blog, we'

ManageEngine's CVE-2022-47966 vulnerability is a critical issue that allows an attacker to gain remote code execution on the server running the ManageEngine software. The vulnerability is caused by two main factors: the validation order of SAML and XSLT injection. Firstly, the vulnerability is caused by how the software handles SAML information validation. SAML is a standard for exchanging authentication and authorization data between systems. In ManageEngine, the software fa

In recent months, we have seen a surge in attacks targeting Exchange Servers. These attacks have been made possible by exploiting the CVE-2022-41040 and CVE-2022-41082. This post will delve into the details of these vulnerabilities and how attackers exploit them to gain access to Exchange Servers. Exploiting CVE-2022-41040: The first step in this attack is exploiting CVE-2022-41040 to gain access to the PowerShell API endpoint of the Exchange Server. This vulnerability arises

Citrix is a global leader in providing digital workspace solutions, and as such, it is a popular target for cyber attackers. One such attack is the recently discovered vulnerability known as CVE-2022-27518. In this blog, we will discuss the details of this vulnerability, how it affects Citrix and the technical workings of this exploit. First, let's define what a CVE is. Common Vulnerabilities and Exposures (CVE) is a standardized way of identifying and categorizing vulnerabil

CVE-2022-27516 is a severe vulnerability recently discovered in Citrix, a widely-used software program. This vulnerability has the potential to wreak havoc on Citrix users, and it is important for individuals and organizations that use the program to take steps to protect themselves against it. The vulnerability in question lies within Citrix's handling of certain types of data inputs. Specifically, the program fails to properly validate and sanitize user-supplied input, allo

CVE-2022-42475 is a recently discovered vulnerability in the software that powers Fortinet, a popular cybersecurity company. This vulnerability has the potential to be exploited by hackers to gain unauthorized access to sensitive information, making it a serious concern for both Fortinet and its customers. The vulnerability is a type of flaw known as a "buffer overflow" error. This occurs when a computer program attempts to store more data in a temporary memory buffer than it

Ransomware is the type of suspicious software Cybercriminals use to encrypt your data, rendering it unusable. As a result, the attackers demand the ransom money to release the victim's data. Once the attack is successfully executed, the victim has to pay money to access their data, but paying to the attacker is not a good decision because once they produce, the attacker knows they can get money from the victim, so they attack again and again. If you don't pay, you'll lose mo

In Microsoft Exchange, the three known vulnerabilities that threat actors use to get initial access are often referred to collectively as Proxyshells. These three known vulnerabilities are CVE-2021-34473, CVE-2021-34523, and CVE-2021- 31207. The attackers use these three vulnerabilities by bypassing the authentication and running a remote code as a privileged user. Microsoft has classified the Proxyshell vulnerabilities as critical. However, the proxyshell vulnerability is re