CVE-2025-22274: It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint…

PriorityP413low2CVSS 4.0

AVNACLATPPRLUIAVCNVILVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EPSS

0.43%

34.7th percentile

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cyberark	endpoint_privilege_manager	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1

suricata·2025-04-02·CVSS 9.8

CVE-2022-22274 [CRITICAL] ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1 ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1"; flow:established,to_server; urilen:>1024; http.uri; content:"/resources/"; startswith; http.protocol; bsize:>8; reference:url,github.com/BishopFox/CVE-2022-22274_CVE-2023-0656; reference:cve,2022-22274; classtype:attempted-dos; sid:2061248; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_02, cve CVE_2022_22274, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Moderate, confidence High, signature_severity Major, tag Exploit, updated_at

Suricata

ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M1

suricata·2025-04-02·CVSS 9.8

CVE-2023-0656 [CRITICAL] ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M1 ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M1 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M1"; flow:established,to_server; urilen:>1024; http.uri; content:"/stats/"; startswith; http.protocol; bsize:>8; reference:url,github.com/BishopFox/CVE-2022-22274_CVE-2023-0656; reference:cve,2023-0656; classtype:attempted-dos; sid:2061253; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_02, cve CVE_2023_0656, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Moderate, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04

Suricata

ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M2

suricata·2025-04-02·CVSS 9.8

CVE-2023-0656 [CRITICAL] ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M2 ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M2 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M2"; flow:established,to_server; urilen:>1024; http.uri; content:"/Security_Services"; startswith; http.protocol; bsize:>8; reference:url,github.com/BishopFox/CVE-2022-22274_CVE-2023-0656; reference:cve,2023-0656; classtype:attempted-dos; sid:2061256; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_02, cve CVE_2023_0656, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2

Suricata

ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M2

suricata·2025-04-02·CVSS 9.8

CVE-2022-22274 [CRITICAL] ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M2 ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M2 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M2"; flow:established,to_server; urilen:>1024; http.uri; content:"/atp/"; startswith; http.protocol; bsize:>8; reference:url,github.com/BishopFox/CVE-2022-22274_CVE-2023-0656; reference:cve,2022-22274; classtype:attempted-dos; sid:2061251; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_02, cve CVE_2022_22274, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_02