386 matches found
CVE-2023-34258
An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution...
PT-2023-18193 ¡ Smr ¡ Smr
Name of the Vulnerable Software and Affected Versions: SMR versions prior to Jan-2023 Release 1 Description: A hardcoded AES key is used to encrypt card emulation PINs in NFC, allowing attackers to access the PIN. Recommendations: For versions prior to Jan-2023 Release 1, update to Jan-2023 Relea...
CVE-2023-22912
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated aka re-used nonce, allowing an adversary to decrypt...
AVIator - Antivirus Evasion Project
AviAtor Ported to NETCore 5 with an updated UI AV|Ator About ://name AV : AntiVirus Ator : Is a swordsman, alchemist, scientist, magician, scholar, and engineer, with the ability to sometimes produce objects out of thin air https://en.wikipedia.org/wiki/Ator About ://purpose AV|Ator is a backdoor...
MariaDB 5.5.0 < 5.5.53 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 5.5.53. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.53 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client mysqldump. Supported versions that are affected a...
Metasploit Weekly Wrap-Up
ADCS - ESC Vulnerable certificate template finder Our very own Grant Willcox has developed a new module which allows users to query a LDAP server for vulnerable Active Directory Certificate Services AD CS certificate templates. The module will print the detected certificate details, and the attac...
CVE-2022-35860
CVE-2022-35860 affects Corsair K63 Wireless keyboard (version 3.1.3). The root cause is missing AES encryption in the 2.4 GHz wireless channel, enabling physically proximate attackers to inject keystrokes and sniff them over the radio. The vulnerability is documented across multiple sources (NVD/...
CVE-2022-35860
Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions...
CVE-2022-35860
Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions...
PT-2022-22973 ¡ Corsair ¡ Corsair K63 Wireless
Name of the Vulnerable Software and Affected Versions: Corsair K63 Wireless version 3.1.3 Description: The issue concerns a lack of AES encryption, allowing physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions. Recommendations: For Corsair K63 Wireless...
BeatRev - POC For Frustrating/Defeating Malware Analysts
BeatRev Version 2 Disclaimer/Liability The work that follows is a POC to enable malware to "key" itself to a particular victim in order to frustrate efforts of malware analysts. I assume no responsibility for malicious use of any ideas or code contained within this project. I provide this researc...
Miscomputation when performing AES encryption in rust-crypto
The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...
New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor
Cybersecurity researchers have disclosed a new ransomware strain called GoodWill that compels victims into donating for social causes and provide financial assistance to people in need. "The ransomware group propagates very unusual demands in exchange for the decryption key," researchers from...
GHSA-CHG9-3C3P-CH23 Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...
Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...
NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit
ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because of this, I started on a full rewrite of NimPackt, dubbed...
Chrome Zero-Day from North Korea
North Korean hackers have been exploiting a zero-day in Chrome. The flaw, tracked as CVE-2022-0609, was exploited by two separate North Korean hacking groups. Both groups deployed the same exploit kit on websites that either belonged to legitimate organizations and were hacked or were set up for...
Elections GoRansom â a smoke screen for the HermeticWiper attack
Executive summary On February 24, 2022, Avast Threat Research published a tweet announcing the discovery of new Golang ransomware, which they called HermeticRansom. This malware was found around the same time the HermeticWiper was found, and based on publicly available information from security...
RUSTSEC-2022-0011 Miscomputation when performing AES encryption in rust-crypto
The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...
Miscomputation when performing AES encryption in rust-crypto
The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...