Helpsystems Cobalt Strike — known CVE vulnerabilities

Every CVE whose affected-product data names Helpsystems Cobalt Strike, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2022-42948 — CVSS 9.8 (critical) — actively exploited: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is…
• CVE-2021-36798 — CVSS 7.5 (high): A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers…
• CVE-2022-23317 — CVSS 7.5 (high): CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant…
• CVE-2022-39197 — CVSS 6.1 (medium) — actively exploited: An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute…