Phorpiex morphs: How a longstanding botnet persists and thrives in the current threat environment

Phorpiex, an enduring botnet known for extortion campaigns and for using old-fashioned worms that spread via removable USB drives and instant messaging apps, began diversifying its infrastructure in recent years to become more resilient and to deliver more dangerous payloads. Today, the Phorphiex...

Phorpiex morphs: How a longstanding botnet persists and thrives in the current threat environment

Phorpiex, an enduring botnet known for extortion campaigns and for using old-fashioned worms that spread via removable USB drives and instant messaging apps, began diversifying its infrastructure in recent years to become more resilient and to deliver more dangerous payloads. Today, the Phorphiex...

CVE-2021-32632 CSRF allowing modification of commands, modules, banphrases through hidden iFrames

Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery CSRF. Hosters of the bot should upgrade to v1.52 or stable to install the patch or, as a workaround, can add one modern dependency...

CVE-2021-32632

Pajbot is a Twitch chat bot. CVE-2021-32632 covers CSRF in Pajbot versions prior to 1.52, enabling modification of commands, modules, and banphrases via hidden iframes. Affected component: the web application lacks sufficient request validation, leading to cross-site forgery. Impact is defined as...

Better Real User Monitoring with BoomerangJS and Akamai mPulse

In this blog, we'll walk through a few different snippet insertion methods and available optimizations. Akamai's real user monitoring RUM solution, mPulse, uses a bit of JavaScript code an mPulse snippet and the BoomerangJS library to collect performance data from a user's Web browser. However, t...

Wallarm NG WAF is ranked as a “High Performer” by G2, Spring 2021!

We are proud to announce that Wallarm NG WAF was ranked as a “High performer” by G2 in the Web Application Firewall category. This award from the G2 platform confirms that our solution is highly rated by current verified Wallarm WAF users, who left unbiased reviews and answers to WAF-related...

Visualize and Analyze Bots with Real User Monitoring

You interact with more than just customers on your website. Bots make up a disproportionate amount of traffic, which can skew human behavior analysis data -- and cause you to make the wrong business decisions. In fact, one Akamai customer with 30% of total traffic from bots noticed a huge gap in...

GitLab: Privilege escalation of "external user" (with maintainer privilege) to internal access through project token

Summary An "external user" a user account with the status external which is granted "Maintainer" role on any project on the GitLab instance where "project tokens" are allowed can elevate its privilege to "Internal". An external user with maintainer permissions could create a project token, which...

CVE-2021-29502

WarnSystem is a cog plugin for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type...

CVE-2021-29502

CVE-2021-29502 concerns the WarnSystem cog for the Red Discord Bot (Laggrons-Dumb-Cogs). The vulnerability arises from unsanitized input in a template, allowing any user to access sensitive information. A patch was released in version 1.3.18; users should upgrade to 1.3.18 or newer and verify wit...

CVE-2021-29502 Remote code execution in the WarnSystem module of Laggrons-Dumb-Cogs

WarnSystem is a cog plugin for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type...

CVE-2021-29501

Ticketer is a command based ticket system cog plugin for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disabl...

Command injection

Ticketer is a command based ticket system cog plugin for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disabl...

CVE-2021-29501

CVE-2021-29501 affects the Ticketer cog (Red Discord Bot) and enables a vulnerability that allows exposure of sensitive information. The documented remediation is to upgrade to version 1.0.1; as a temporary workaround, unload the Ticketer cog to disable the exploitable code. Public disclosures ac...

CVE-2021-29501 Remote code execution in ticketer

Ticketer is a command based ticket system cog plugin for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disabl...

Red Discord Bot 命令注入漏洞

Red Discord Bot is a modular robot written in Python by an individual developer. The bot software can be configured to perform different functions based on different modules. A command injection vulnerability exists in Red discord bot. The vulnerability stems from a Ticketer plugin in the program...

PT-2021-18256 · Unknown · Red Discord Bot +1

Name of the Vulnerable Software and Affected Versions: Ticketer cog versions prior to 1.0.1 Description: A vulnerability has been found in the Ticketer cog, a command-based ticket system plugin for the red Discord bot, allowing Discord users to expose sensitive information. Recommendations: For...

PT-2021-18257 · Unknown · Red Discord Bot +1

Name of the Vulnerable Software and Affected Versions: WarnSystem versions prior to 1.3.18 Description: A vulnerability has been found in the WarnSystem cog for the Red discord bot, allowing any user to access sensitive information by setting up a specific template that is not properly sanitized...

@ioup/mia-bot (=0.0.1) potentially affected by CVE-2021-23378 via picotts (=0.1.1)

picotts NPM version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on picotts and may be impacted: - @ioup/mia-bot =0.0.1 Source cves: CVE-2021-23378 Source advisory: OSV:GHSA-WQ7Q-5V6J-XFV6...

CVE-2021-29493

Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit allows discord users to craft a message that can reveal sensitive and harmful information. Users can upgrade to version 5a84d60018468e5c0346f7ee74b2b4650a6dade7...