Awesome-Red-Teaming

This is a list of resources for Red Teaming, a list that will be updated regularly with the latest adversarial tactics and techniques based on the Mitre ATT&CK framework. The list covers various topics such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credenti...

CVE-2020-24593

Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation...

CVE-2020-24593

Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation...

Unspecified vulnerability in Kubernetes kube-controller-manager

Kubernetes is an open source Docker container cluster management system released by the Linux Foundation. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. kube-controller-manager is one of the control...

Advantech iView SQL Injection Vulnerability

Advantech iView is a device management application from Advantech. A SQL injection vulnerability exists in Advantech iView 5.6 and prior versions. An attacker can exploit this vulnerability to obtain user credentials, read or modify information, and execute code...

Broad, Ongoing Cyberattacks Targeting Australia Underscore Need for Behavioral-Based Cybersecurity

On Friday the Australian Federal Government detailed sustained ‘copy-paste’ threats on government and business throughout the country. According to the Government: “‘Copy-paste compromises’ is derived from … heavy use of proof-of-concept exploit code, web shells and other tools copied almost...

Broad, Ongoing Cyberattacks Targeting Australia Underscore Need for Behavioral-Based Cybersecurity

On Friday the Australian Federal Government detailed sustained ‘copy-paste’ threats on government and business throughout the country. According to the Government: “‘Copy-paste compromises’ is derived from … heavy use of proof-of-concept exploit code, web shells and other tools copied almost...

SAP Adaptive Server Enterprise Information Disclosure Vulnerability (CNVD-2020-29753)

SAP Adaptive Server Enterprise is a relational database server from SAP. An information disclosure vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability to obtain account credentials, manipulate system data, and impact system availability...

CVE-2020-12680

Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and th...

CVE-2020-10377

A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credentials. A successful exploit could allow an attacker to access the system with compromised user credentials...

Attack matrix for Kubernetes

Kubernetes, the most popular container orchestration system and one of the fastest-growing projects in the history of open source, becomes a significant part of many companies’ compute stack. The flexibility and scalability of containers encourage many developers to move their workloads to...

Tribal SITS: Vision Authorization Issue Vulnerability

Tribal SITS: Vision is a higher education student information management system from Tribal UK. An authorization issue vulnerability exists in Tribal SITS: Vision version 9.7.0 that stems from the Uniface TLS Driver not being enabled by default. An attacker can exploit this vulnerability to acces...

CVE-2019-19127

An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs because the Uniface TLS Driver is not enabled by default. Thi...

Credential Access – Password Filter DLL

Microsoft has introduced password filters as a method for systems administrators to enforce password policies and change notification. Filters are used to validate new passwords… Continue reading - Credential Access - Password Filter DLL...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Snatch Ransomware

During the end of the year 2019, a ransomware named ‘Snatch” was discovered. Snatch ransomware will force Windows to reboot in Safe Mode where most of the software and system drivers will not be running in order to perform the file encryption process. Similar to the other variants of ransomware, ...

McAfee Advanced Threat Defense (ATD) Information Disclosure Vulnerability

McAfee Advanced Threat Defense ATD is a set of threat detection and defense solutions from the U.S. company McAfee McAfee, providing malware analysis, shared threat intelligence and isolation of compromised systems and other features. An information disclosure vulnerability exists in McAfee...

Rakuma App vulnerable to authentication information disclosure

Overview Rakuma App provided by Rakuten, Inc. contains an authentication information disclosure vulnerability CWE-200. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Google Chrome HTTP Authentication Spoofing Vulnerability (CNVD-2019-38241)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 78.0.3904.70. A remote attacker can exploit the vulnerability to spoof HTTP authentication windows and gain unauthorized access to user credentials...

Missing permission checks in google-kubernetes-engine allowed validating and obtaining data

Missing permission checks in google-kubernetes-engine allowed users with Overall/Read permission to obtain limited information about the scope and access of a credential with an attacker-specified credential ID obtained through another method. google-kubernetes-engine now requires Job/Configure...

The vulnerability of the Jenkins Credentials plugin, related to the leakage of file and directory information, allows attackers to create or update credentials and gain access to files containing PKCS#12 certificates.

The vulnerability of the Jenkins Credentials plugin is related to the leakage of information about files and directories. Exploiting this vulnerability allows a malicious actor to create or update credentials and gain access to files containing PKCS12 certificates...