Metasploit Weekly Wrap-Up

Bofloader - Windows Meterpreter Gets Beacon Object File Loader Support This week brings a new and frequently requested feature to the Windows Meterpreter, the Beacon Object File loader. This new extension, bofloader, allows for users to execute Beacon Object Files as written for either Cobalt...

A Bootiful Podcast: Spring and Java community legend Marten Deinum

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to longtime Spring community member and legend Marten Deinum @mdeinum about scuba diving, software, Spring, community, and more. Also: I fixed the odd silence in the middle of the last few episodes! thanks for suffering through it...

CVE-2022-40895

CVE-2022-40895 affects NeDi’s web UI login and Community login, where an insecure design in the forgot-password flow enables unauthenticated, remote user enumeration and brute-force attempts against valid usernames. Reported impact is integrity compromise for affected devices; attack vector is ne...

CVE-2022-36551

A Server Side Request Forgery SSRF in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling...

PYSEC-2022-300

A Server Side Request Forgery SSRF in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling...

communitycarereview.com.au Cross Site Scripting vulnerability OBB-2974907

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

community.invasives.com.au Cross Site Scripting vulnerability OBB-2974906

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Swaps could be blocked temporarily

Lines of code Vulnerability details Impact In the swap and swapSupportingFeeOnInputTokens functions the community fee payment is called by the function payCommunityFee. The payCommunityFee will fail if the vault address is 0x0 and all the swap will be reverted by the safeTransfer. The...

Information disclosure

A vulnerability in the Simple Network Management Protocol SNMP of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authenticated, remote attacker to access sensitive information. This vulnerability is due to insufficient restrictions that allow a sensitive...

Vulnerabilities fixed in GitLab Community Edition (CE) and Enterprise Edition (EE).

GitLab has fixed vulnerabilities in Community Edition CE and Enterprise Edition EE. The vulnerabilities allow a malicious able to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Remote code execution User Rights Access to sensitiv...

How one product manager builds community at Microsoft Security

I first met Joey Cruz not long after he joined the Microsoft Identity and Network Access IDNA team when he helped create demos for a keynote speech I was delivering. Joey has a way of making you feel that even if something goes sideways, it will all be okay because he will make sure it is. As...

EyesOfNetwork SQL Injection Vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution from the EyesOfNetwork community. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. EyesOfNetwork EON 5.3.11 and prior versions...

[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response

!\Security Nation\ Taki Uchiyama of Panasonic on Product Security and Incident Responsehttps://blog.rapid7.com/content/images/2022/09/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Taki Uchiyama about his work on Panasonic’s Product Security Incident Response...

The users can steal the pages from the community reserve

Lines of code Vulnerability details Impact community reserve could be losing some pages Proof of Concept In case mintCommunityPages start minting let's say 20 pages if Alice has invoke mintFromGoo before this looop for uint256 i = 0; i numPages; i++ mintcommunity, ++lastMintedPageId; Has finished...

GOO tokens will be locked inside the GobblerReserve contract.

Lines of code Vulnerability details Impact GOO will be locked inside the GobblerReserve contract. This contract is used as a reserve contract for the team and community and the minted gobblers will produce GOO tokens continuously. But there is no logic to withdraw or transfer the GOO tokens. Proo...

CVE-2022-1532

creationtimestamp| type| source ---|---|--- 2022-09-23 11:56:44+00:00| published-proof-of-concept| https://t.me/ETHICALHACKERSCOMMUNITY2/1238...

My SpringOne 2022

It has taken me an embarrassingly long time to appreciate and understand that the devil is in the details regarding software development. Writing happy-path business logic isnt the hard part! Its the failure cases, observability, resilience, and process. Its security and other so-called...

Researchers Uncover Years-Long Mobile Spyware Campaign Targeting Uyghurs

A new wave of a mobile surveillance campaign has been observed targeting the Uyghur community as part of a long-standing spyware operation active since at least 2015, cybersecurity researchers disclosed Thursday. The intrusions, originally attributed to a threat actor named Scarlet Mimic back in...

benpottervo.com Cross Site Scripting vulnerability OBB-2941060

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...