Development of Corporate Applications Based on Artificial Intelligence

By Owais Sultan Technologies based on Artificial intelligence can be used in corporate management since the indisputable advantage of these technologies is the ability to analyze large amounts of data without significant resource costs. The ability to use AI technologies is especially relevant wh...

This shouldn't have happened: A vulnerability postmortem

Posted by Tavis Ormandy, Project Zero Introduction This is an unusual blog post. I normally write posts to highlight some hidden attack surface or interesting complex vulnerability class. This time, I want to talk about a vulnerability that is neither of those things. The striking thing about thi...

Vulristics Command Line Interface, improved Product & Vuln. Type Detections and Microsoft Patch Tuesday November 2021

Hello everyone! In this episode I want to highlight the latest changes in my Vulristics project. For those who dont know, this is a utility for prioritizing CVE vulnerabilities based on data from various sources.. Currently Microsoft, NVD, Vulners, AttackerKB. Command Line Interface I started...

Prototype Pollution in fabiocaccamo/utils.js

Summary I discovered a prototype pollution vulnerability via utils.js method analysis. javascript set: functionobj, path, value var keys = path.split'.'; var key; var cursor = obj; for var i = 0, j = keys.length; i j; i++ key = keysi; if !TypeUtil.isObjectcursorkey cursorkey = ; if i j - 1 cursor...

Dell Emc Streaming Data Platform 安全漏洞

Dell Emc Streaming Data Platform is a platform for ingesting, storing and analyzing continuous streaming data in real time from Dell USA. communication to an unencrypted format...

Johnson Controls CEM Systems AC2000

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Controlled Electronic Management Systems, Ltd., a subsidiary of Johnson Controls, Inc. Equipment: CEM Systems AC2000 Vulnerability: Off-by-one Error 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2021-35517, CVE-2021-36090)

Summary There are multiple vulnerabilities in the Apache Commons Compress library that is used by WebSphere Application Server Liberty. This has been addressed. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out ...

GSD-2021-1002274 scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

scsi: lpfc: Fix listadd corruption in lpfcdraintxq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

ELFXtract - An Automated Analysis Tool Used For Enumerating ELF Binaries

ELFXtract is an automated analysis tool used for enumerating ELF binaries Powered by Radare2 and r2ghidra This is specially developed for PWN challenges and it has many automated features It almost displays every details of the ELF and also decompiles its ASM to C code using r2ghidra Decompiling...

Huawei iMaster NCE-Fabric Cross-Site Scripting Vulnerability

Huawei IMaster Nce-Fabric is a network automation and intelligence platform that integrates management, control, analysis, and artificial intelligence Ai functions from Huawei China.A security vulnerability exists in Huawei iMaster NCE-Fabric, which stems from a client-side module that fails to...

IBM OpenPages with Watson Arbitrary Code Execution Vulnerability

IBM OpenPages with Watson is an AI-driven solution for financial risk analysis. The platform is based on AI technology to predict risk factors and minimize risk in financial activities by integrating, automatically identifying, measuring, monitoring, analyzing, and managing risk data through step...

Redash input validation error vulnerability

Redash is a data integration and analysis solution from the Israeli company Redash. Redash 10.0.0 and earlier versions are vulnerable to an input validation error, which stems from the program's implementation of the Google sign-in feature that does not properly use the "state" parameter to pass...

Password usage analysis of brute force attacks on honeypot servers

As Microsoft’s Head of Deception, Ross Bevington is responsible for setting up and maintaining honeypots that look like legitimate systems and servers. Honeypot systems are designed to pose as an attractive target for attackers. Sometimes they are left vulnerable to create a controllable and safe...

MixinPurchase:shareKey allows to generate keys without purchasing

Handle GiveMeTestEther Vulnerability details Impact the shareKey function allows a user to share some time with another user that doesn't already has/had a key and this generates a new key. This even allows to generate more keys than maxNumberOfKeys. attacker generates a lot of EOA adresses, buys...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

Arrest in ‘Ransom Your Employer’ Email Scheme

In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employers network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the...

Wireshark Input Validation Error Vulnerability (CNVD-2022-11205)

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark suffers from an input validation error vulnerability that can be exploited by...

Metabase Information Disclosure Vulnerability

Metabase is an open source data analysis platform from Metabase, Inc. An information disclosure vulnerability exists in Metabase, which stems from a lack of permission validation in the product's admin-settings-maps-custom maps-add a map operation. An attacker could obtain sensitive information...

Wireshark Input Validation Error Vulnerability (CNVD-2021-91421)

Wireshark is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.Wireshark suffers from an input validation error vulnerability that stems from insufficient validation in the Modbu...

Join us at InfoSec Jupyterthon 2021

We’re excited to invite our community of infosec analysts and engineers to the second annual InfoSec Jupyterthon taking place on December 2-3, 2021. This is an online event organized by our friends in the Open Threat Research Forge, together with folks from the Microsoft Threat Intelligence Cente...