Russian Espionage Group Updates Custom Malware Suite

The advanced persistent threat APT known as Turla is targeting government organizations using custom malware, including an updated trio of implants that give the group persistence through overlapping backdoor access. Russia-tied Turla a.k.a. Ouroboros, Snake, Venomous Bear or Waterbug is a...

Mida eFramework 2.9.0 Backdoor Access

Exploit Title: Mida eFramework 2.9.0 - Back Door Access Google Dork: Server: Mida eFramework Date: 2020-08-27 Exploit Author: elbae Vendor Homepage: https://www.midasolutions.com/ Software Link: http://ova-efw.midasolutions.com/ Reference:...

Malicious Package in uglyfi.js

Version 0.17.3 of uglyfi.js contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

GHSA-F7G4-FM4C-54M9 Malicious Package in yeoman-genrator

Version 2.0.2 of yoeman-generator contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

GHSA-FM7R-2PR7-RW2P Malicious Package in yeoman-genrator

Version 3.1.1 of yeoman-genrator contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

Malicious Package in require-ports

Version 10.4.0 of require-ports contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

Malicious Package in bowe

Version 1.8.4 of bowee contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

V-SOL OLTs Backdoor / Privilege Escalation

Hello, Please find a text-only version below sent to security mailing lists. The complete version on "Multiple vulnerabilities found in V-SOL OLTs" is posted here: https://pierrekim.github.io/blog/2020-07-14-v-sol-olt-0day-vulnerabilities.html === text-version of the advisory === -----BEGIN PGP...

CDATA OLTs Backdoor / Privilege Escalation / Information Disclosure Vulnerabilities

Various CDATA OLTs suffer from backdoor access with telnet, credential leaks, shell escape with root privileges, denial of service, and weak encryption algorithm vulnerabilities. Advisory Information Title: Multiple vulnerabilities found in CDATA OLTs Advisory URL:...

CDATA OLTs Backdoor / Privilege Escalation / Information Disclosure

Hello, Please find a text-only version below sent to security mailing lists. The complete version on "Multiple vulnerabilities found in CDATA OLTs" is posted here: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html === text-version of the advisory === -----BEGIN PGP...

Critical Bugs and Backdoor Found in GeoVision's Fingerprint and Card Scanners

GeoVision, a Taiwanese manufacturer of video surveillance systems and IP cameras, recently patched three of the four critical flaws impacting its card and fingerprint scanners that could've potentially allowed attackers to intercept network traffic and stage man-in-the-middle attacks. In a report...

NETGEAR DGN2200 Operating System Command Injection Vulnerability

The NETGEAR DGN2200 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR DGN2200v4 version prior to 2017-01-06. An attacker can exploit the vulnerability with specially crafted commands to install a backdoor in the router, modify Internet traffic and access files in t...

Realtek Chip ADSL Cat/Optical Cat Serial Port Command Execution Vulnerability in Realtek Semiconductor Co.

Realtek Corporation Realtek is a supplier of audio and networking chips. Realtek Semiconductor Corporation Realtek chip ADSL cat/optical cat serial port there is a command execution vulnerability, an attacker can use the vulnerability through the modem's arbitrary IPv4 address to access the...

Malicious Package

Overview Version 1.0.0 of require-port contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens ...

DEF CON 2019: 35 Bugs in Office Printers Offer Hackers an Open Door

LAS VEGAS — At least 35 significant vulnerabilities in six commonly used enterprise printers have been uncovered, manufactured by HP, Ricoh, Xerox, Lexmark, Kyocera and Brother. The bugs will be presented by NCC Group at a DEF CON session entitled “Why You Should Fear Your Mundane Office Equipmen...

Joomla Ari Image Slider CSRF Backdoor Access Vulnerability

Joomla is an open source content management system CMS. A CSRF backdoor access vulnerability exists in Joomla Ari Image Slider. An attacker can exploit the vulnerability to spoof a client to make an unintentional request to the web server, which may result in data exposure or unintended code...

WordPress FormCraft plugin CSRF backdoor access vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A CSRF backdoor access vulnerability exists in the WordPress FormCraft plugin, which can be exploited by an attacker to perform arbitrary operations by inducing the...

Security Bulletin: Backdoor Access Vulnerability in IBM System Networking Products (CVE- 2014-4752)

Summary Backdoor access discovered on IBM System Networking Switches Vulnerability Details Abstract Backdoor access discovered on IBM System Networking Switches Content Vulnerability Details: CVEID: CVE-2014-4752 Descriptoin: It has been reported that the firmware that runs on some of the IBM...

Dual Data Leaks of Blur, Town of Salem Impact Millions

The new year has started off with the disclosure of two high-profile data breaches exposing the personal and password data of millions of people. Popular role-playing game Town of Salem saw the email addresses and passwords of more than 7.6 million players hacked; while a separate database issue...

Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets

Our analysis of a targeted attack that used a language-specific word processor shows why its important to understand and protect against small-scale and localized attacks as well as broad-scale malware campaigns. The attack exploited a vulnerability in InPage, a word processor software for specif...