Tag
Scriban Template Engine Vulnerability: Arbitrary CLR Property Writes (Mass Assignment & Setter Bypass)
2 TTPsThe Scriban templating engine, specifically its `TypedObjectAccessor`, allows template code to write to arbitrary CLR object properties, including those with `private set`, `internal set`, and `init` modifiers, effectively bypassing intended C# access restrictions. This mass assignment (CWE-915) and access-modifier bypass (CWE-284) vulnerability can lead to unauthorized modification of sensitive host object properties, such as changing `user.is_admin = true`, with changes persisting after template rendering, affecting Scriban versions up to and including 7.2.1, with the `init` bypass specifically impacting .NET 5+.
Steeltoe Host Header Bypass Vulnerability (CVE-2026-50194)
1 rule 2 TTPs 1 CVEAn unauthenticated remote attacker can bypass port isolation in Steeltoe applications configured with `Management:Endpoints:Port` by spoofing the Host HTTP header, allowing access to all actuator endpoints (CVE-2026-50194).
Multiple Vulnerabilities in Microsoft .Net (CVE-2026-45491, CVE-2026-45591)
2 rules 2 TTPs 2 CVEsMultiple vulnerabilities, CVE-2026-45491 and CVE-2026-45591, have been discovered in Microsoft .Net and ASP.NET Core versions, allowing a remote attacker to cause a denial of service and compromise data integrity across Windows, Linux, and macOS platforms.
CVE-2026-32175 .NET Core Tampering Vulnerability
2 rules 1 TTP 1 CVEA tampering vulnerability exists in .NET 8.0, .NET 9.0, and .NET 10.0 due to improper handling of specially crafted files, potentially allowing an attacker to write arbitrary files and directories to specific locations on a vulnerable system with limited control over the destination.
Gremlin Stealer Evolves with Advanced Obfuscation and Session Hijacking
2 rules 8 TTPs 1 IOCThe Gremlin stealer malware has evolved with advanced obfuscation techniques, crypto clipping, and session hijacking capabilities to steal sensitive information from compromised systems.
CVE-2026-32226 .NET Framework Denial of Service Vulnerability
2 rules 1 TTP 1 CVECVE-2026-32226 is a denial of service vulnerability in the .NET Framework that can be mitigated by applying the latest security update.
Meridian Library Multiple Defense-in-Depth Gaps
3 rules 5 TTPsMultiple defense-in-depth gaps exist in Meridian versions prior to 2.1.1, including high severity issues related to bypassing safety caps on collection mapping that can lead to resource exhaustion, along with medium and low severity issues affecting constructor selection, telemetry, retry mechanisms, and exception handling.
.NET Uncontrolled Resource Consumption Vulnerability (CVE-2026-26171)
1 rule 1 CVECVE-2026-26171 is a vulnerability in .NET that allows an unauthorized attacker to perform a denial-of-service attack over a network due to uncontrolled resource consumption.
.NET Spoofing Vulnerability (CVE-2026-32178)
2 rules 1 TTP 1 CVECVE-2026-32178 is a vulnerability in .NET that allows for network spoofing due to improper neutralization of special elements, potentially enabling attackers to impersonate legitimate entities.
Tmds.DBus Vulnerability Allows Signal Spoofing and Resource Exhaustion
2 rules 1 TTP 1 CVETmds.DBus and Tmds.DBus.Protocol are vulnerable to signal spoofing, resource exhaustion, and application crashes due to malformed messages from malicious D-Bus peers on the same bus.
Suspicious .NET Code Compilation via Unusual Parent Processes
2 rules 9 TTPsThe execution of .NET compilers (csc.exe, vbc.exe) with suspicious parent processes (wscript.exe, mshta.exe, etc.) indicates potential attempts to compile code after delivery for defense evasion and execution.
PowerShell Loading .NET Assemblies via Reflection
2 rules 1 TTPThis analytic detects PowerShell scripts leveraging .NET reflection to load assemblies into memory, a technique commonly used by threat actors to bypass defenses and execute malicious code.