Schneider Electric EcoStruxure Cybersecurity Admin Expert 安全漏洞

Schneider Electric EcoStruxure Cybersecurity Admin Expert Schneider Electric EcoStruxure CAE is a cybersecurity administration expert from Schneider Electric, France. A security vulnerability exists in versions of Schneider Electric EcoStruxure Cybersecurity Admin Expert prior to 2.2, which stems...

CVE-2022-32747

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...

CVE-2022-47767

A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 included. This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300,...

Solar Log Gateway 安全漏洞

Solar Log Gateway is a residential monitoring system from Solar Log. A security vulnerability exists in Solar Log Gateway firmware versions v4.2.7 through v5.1.1, which stems from a vulnerability in its web dashboard that allows a remote attacker to log in with super administrator privileges via ...

CVE-2022-47767

The CVE-2022-47767 issue affects Solar-Log Gateway devices running firmware v4.2.7 through v5.1.1, where a backdoor in the web dashboard allows remote login with super administrator privileges. The vulnerability is rooted in the gateway’s web panel security, enabling unauthenticated remote access...

CVE-2022-47767

A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 included. This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300,...

New BOLDMOVE Backdoor uses FortiOS vulnerability for initial access

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A suspected China-nexus campaign has exploited a vulnerability in Fortinets FortiOS SSL-VPN, known as CVE-2022-42475. The exploitation was believed to have occurred as early as October 2022 and the targe...

Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware

A suspected China-nexus threat actor exploited a recently patched vulnerability in Fortinet FortiOS SSL-VPN as a zero-day in attacks targeting a European government entity and a managed service provider MSP located in Africa. Telemetry evidence gathered by Google-owned Mandiant indicates that the...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

Malicious code in speedtestrun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b100bd6200644b48f81811927710a78c261d325facb39b0425c7da01f37d6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload

The plugin does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. 1 As an Author, upload a picture via http://vulnerable-site.tld/wp-admin/upload.php 2 Press on the new picture's thumbnail to see the attachment's details 3...

New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild

Unidentified threat actors have deployed a new backdoor that borrows its features from the U.S. Central Intelligence Agency CIA's Hive multi-platform malware suite, the source code of which was released by WikiLeaks in November 2017. "This is the first time we caught a variant of the CIA Hive...

Inlislite 3.2 Insecure Settings

==================================================================================================================================== | Title : Inlislite V3.2 Backdoor Account Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 103.064-bit | |...

Timely patching is good, but sometimes it's not enough

Ransomware gangs have shown that they can play a long game, so it shouldnt come as a surprise to learn of one prepared to wait months to make use of a compromised system. S-RMs Incident Response team shared details of a campaign attributed to the Lorenz ransomware group that exploited a specific...

Threat Round up for January 6 to January 13

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Jan. 6 and Jan. 13. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

WordPress Slider Revolution 4.x.x Shell Upload

================================================================================================= | Title : WordPress - Slider Revolution 4.x.x WordPress - arbitrary file upload exploit | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.064-bit | |...

IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours

A recent IcedID malware attack enabled the threat actor to compromise the Active Directory domain of an unnamed target less than 24 hours after gaining initial access, while also borrowing techniques from other groups like Conti to meet its goals. "Throughout the attack, the attacker followed a...

Multiple vulnerabilities in PIXELA PIX-RT100

Overview PIX-RT100 provided by PIXELA CORPORATION contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2023-22304 Backdoor access issue CWE-912 - CVE-2023-22316 MASAHIRO IIDA of LAC Co.,Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the develop...

JVN#57296685: Multiple vulnerabilities in PIXELA PIX-RT100

PIX-RT100 provided by PIXELA CORPORATION contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2023-22304 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.0 CVSS v2| AV:A/AC:L/Au:S/C:C/I:C/A:C| Base Score: 7.7...

StrongPity Hackers Distribute Trojanized Telegram App to Target Android Users

The advanced persistent threat APT group known as StrongPity has targeted Android users with a trojanized version of the Telegram app through a fake website that impersonates a video chat service called Shagle. "A copycat website, mimicking the Shagle service, is used to distribute StrongPity's...