Unspecified Vulnerability in BinDiff

BinDiff is a tool for binary file analysis and comparison. A security vulnerability exists in BinDiff that can be exploited by an attacker to create a specific IdaPro .i64 file will cause the BinDiff plugin to load an invalid memory offset. The vulnerability can be exploited by an attacker to tak...

Plixer Scrutinizer SQL Injection Vulnerability

Plixer Scrutinizer is a network traffic analysis system that collects, analyzes, visualizes, and reports data from every network conversation and digital transaction to provide security and network intelligence. A SQL injection vulnerability exists in Plixer Scrutinizer version 19.0.2. An attacke...

Forblaze - A Python Mac Steganography Payload Generator

Forblaze is a project designed to provide steganography capabilities to Mac OS payloads. Using python3, it will build an Obj-C file for you which will be compiled to pull desired encrypted URLs out of the stego file, fetch payloads over https, and execute them directly into memory. It utilizes...

Wrong trading pricing calculations

Handle 0xsanson Vulnerability details Impact In the Pricing contract, an agent can manipulate the trading prices by spamming an high amount of trades. Indeed an agent can create an high amount of orders at an arbitrary price and with a near-zero amount so the agent doesn't even need large funds;...

CISA’s CSET Tool Sets Sights on Ransomware Threat

CISA has released a new module in its Cyber Security Evaluation Tool CSET: the Ransomware Readiness Assessment RRA. CSET is a desktop software tool that guides network defenders through a step-by-step process to evaluate their cybersecurity practices on their networks. CSET—applicable to both...

Use of deprecated Chainlink API

Handle 0xRajeev Vulnerability details Impact The contracts use Chainlink’s deprecated API latestAnswer. Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs. Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to...

Logic error in fee subtraction

Handle 0xsanson Vulnerability details Impact In LibBalances.applyTrade we need to collect a fee from the trade. The current code however subtracts a fee from the short position and adds it to the long. The correct implementation is to subtract a fee to both see TracerPerpetualSwaps.solL272. This...

Software composition analysis 101

Open source is everywhere. Learn how software composition analysis can automate open source management to secure your applications...

What is Penetration Testing❓ Definition, Stages, Techniques, Pros and Cons

The general concept is that penetration testing, frequently known as upright hacking, separates network security weaknesses by mimicking endeavors to penetrate protections. If it’s anything but, a real aggressor may exploit similar imperfections. Pen testing may manage a creation system or one...

REvil Ransomware Code Ripped Off by Rivals

They say imitation is the sincerest form of flattery: The LV ransomware, a strain that cropped up just this spring, turns out to be based on what is most likely pirated REvil ransomware code, according to researchers. A malware analysis of LV from Secureworks Counter Threat Unit CTU found that it...

Unused return value from Transfer()/ TransferFrom()

Handle JMukesh Vulnerability details Impact return value from transfer/ transferFrom confirm the success of that function call, these return should be checked Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps utilise the return value to check the success of the function ---...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during PLY file syntax analysis. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created malware file or a...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during the syntactic analysis of GLB and STL files. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created...

Attack Surface Analysis Part 3: Red and Purple Teaming

Part 3: Red and Purple Teaming This is the third and final installment in our 2021 series around attack surface analysis. In part 1 I offered a description and the value and challenge of vulnerability assessment. Part 2 explored the why and how of conducting penetration testing and gave some tips...

Responsive Tourism Website 3.1 Remote Code Execution

Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution RCE Unauthenticated Date: 22.06.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14838/simple-responsive-tourism-website-using-php-free-source-code.html Version: V 3.1 Tested on: MacOS &...

[SECURITY] Fedora 34 Update: radare2-5.3.1-1.fc34

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 33 Update: radare2-5.3.1-1.fc33

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

Lessons Learned from 100 Data Breaches: Part 4, Trends in Average Volumes of Stolen Records

Imperva research shows an increase in the volume of data stolen every year. In 2020, we started to see more and more breaches that exfiltrate records in billions. Based on the analysis of thousands of data breach details published on dbdigest, we made calculations on the raw data and found some...

pentest-wiki

This is a collection of information gathering tools and techniques for penetration testing and security research. The repository contains various scripts and documentation for gathering information about a target organization, including IP analysis, whois analysis, and social media research. The...

Missing call to removeUserFromOrderbook after user is foreclosed

Handle 0xRajeev Vulnerability details Impact Orderbook’s removeUserFromOrderbook is used to delete/remove user’s bids when they are deemed foreclosed. This is called in Market newRental and Treasury withdrawDeposit when users are determined to be foreclosed given their deposit and bid situation...