Netgear DGN2200v1 - Remote Command Execution (Unauthenticated) Exploit

Exploit Title: Netgear DGN2200v1 - Remote Command Execution RCE Unauthenticated Exploit Author: SivertPL Vendor Homepage: https://www.netgear.com/ Version: All prior to v1.0.0.60 !/usr/bin/python """ NETGEAR DGN2200v1 Unauthenticated Remote Command Execution Author: SivertPL email protected Date:...

Backdoor.Win32.Zombam.l Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/9729e9fc004ea49d3c2ddee28736dae3B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.l Vulnerability: Unauthenticated URL Command Injection Description: Zombam...

Ongoing Spearphishing Campaign Targets Afghan Gov’t

Chinese-speaking cyberespionage actors have targeted the Afghan government, using Dropbox for command-and-control C2 communications and going so far as to impersonate the Office of the President to infiltrate the Afghan National Security Council NSC, researchers have found. According to a report...

Indexsinas SMB Worm Campaign Infests Whole Enterprises

The Indexsinas SMB worm is on the hunt for vulnerable environments to self-propagate into, researchers warned – with a particular focus on the healthcare, hospitality, education and telecommunications sectors. Its end goal is to drop cryptominers on compromised machines. Indexsinas, aka...

Atlassian Bugs Could Have Led to 1-Click Takeover

Atlassian, a platform used by 180,000 customers to engineer software and manage projects, could have been hijacked with a single click due to security flaws, researchers have disclosed. On Thursday, Check Point Research CPR published a report PDF outlining how an attacker could have exploited the...

Trojan-Dropper.Win32.Krepper.a Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ee699b4055c6199f9826681797d64f0b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Krepper.a Vulnerability: Unauthenticated Remote Command Execution Description:...

CVE-2021-20025: SonicWall Email Security Appliance Backdoor Credential

The virtual, on-premises version of the SonicWall Email Security Appliance ships with an undocumented, static credential, which can be used by an attacker to gain root privileges on the device. This is an instance of CWE-798: Use of Hard-coded Credentials, and has an estimated CVSSv3 score of 9.1...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

PT-2021-3322

Name of the Vulnerable Software and Affected Versions D-Link DIR-2640-US version 1.01B04 Description The issue is related to Incorrect Access Control in the D-Link DIR-2640-US router. When setting up PPPoE, the router starts the quagga process, which uses the default password and port, allowing a...

Novel ‘Victory’ Backdoor Spotted in Chinese APT Campaign

An ongoing surveillance operation has been uncovered that targets a Southeast Asian government, researchers said – using a previously unknown espionage malware. According to Check Point Research, the attack involves spear-phishing emails with malicious Word documents to gain initial access, along...

Researchers Discover First Known Malware Targeting Windows Containers

Security researchers have discovered the first known malware, dubbed "Siloscope," targeting Windows Server containers to infect Kubernetes clusters in cloud environments. "Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers," said Unit 42 researcher...

Backdoor.Win32.Neakse.bit Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/20863ba09c31037b1b3220fc6da100e1.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Neakse.bit Vulnerability: Insecure Permissions Description: The malware creates two...

Backdoor.Win32.Androm.df Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/bf60f5b5c901bab08484838447f1b85e.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Androm.df Vulnerability: Unauthenticated Remote Command Execution Description: The...

edusrc_POC

This repository contains a collection of Python scripts, each designed to exploit vulnerabilities in various web applications. The scripts are written in Chinese and appear to be intended for use on Chinese-language systems. The scripts are categorized into several groups, each targeting a specif...

Experts Uncover Yet Another Chinese Spying Campaign Aimed at Southeast Asia

An ongoing cyber-espionage operation with suspected ties to China has been found targeting a Southeast Asian government to deploy spyware on Windows systems while staying under the radar for more than three years. "In this campaign, the attackers utilized the set of Microsoft Office exploits and...

PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution

Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution Date: 23 may 2021 Exploit Author: flast101 Vendor Homepage: https://www.php.net/ Software Link: - https://hub.docker.com/r/phpdaily/php - https://github.com/phpdaily/php Version: 8.1.0-dev Tested on: Ubuntu 20.04 References: -...

PHP 8.1.0-dev - (User-Agentt) Remote Code Execution Exploit

Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution Exploit Author: flast101 Vendor Homepage: https://www.php.net/ Software Link: - https://hub.docker.com/r/phpdaily/php - https://github.com/phpdaily/php Version: 8.1.0-dev Tested on: Ubuntu 20.04 References: -...

PHP 8.1.0-dev User-Agentt Remote Code Execution

Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution Date: 23 may 2021 Exploit Author: flast101 Vendor Homepage: https://www.php.net/ Software Link: - https://hub.docker.com/r/phpdaily/php - https://github.com/phpdaily/php Version: 8.1.0-dev Tested on: Ubuntu 20.04 References: -...