6 CVEs matched to Strike by name in NVD, 2 on CISA's Known Exploited list.
Back to the Strike profile · Alternatives to Strike · CVE RSS feed
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely e…
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Stri…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2023 | 1 | 0 | 0 | 0 | 0 | 1 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 |
| 2014 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2008 | 0 | 1 | 0 | 0 | 0 | 1 |
| 2004 | 0 | 1 | 0 | 0 | 0 | 1 |
2 of 6 matched CVEs are listed. 2 are past the remediation due date CISA set.
Most recent additions
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2022-39197 | 46% | 99% |
| CVE-2021-36798 | 4.3% | 91% |
| CVE-2004-1900 | 3.8% | 90% |
| CVE-2022-42948 | 2.7% | 86% |
| CVE-2008-0733 | 1.0% | 61% |
| CVE-2014-5845 | 0.3% | 18% |
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitrary code via format s…
A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 serve…
SQL injection vulnerability in index.php in CS Team Counter Strike Portals allows remote attackers to execute arbitrary SQL commands via the id parameter, as de…
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerabil…
A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communicatio…
The Strike Fighters Israel (aka com.thirdwire.strikefighters.mideast.android) application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker…
SQL injection vulnerability in index.php in CS Team Counter Strike Portals allows remote attackers to execute arbitrary SQL commands via the id parameter, as demonstrated using the downloads page.
Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.