Evolution of BazarCall Social Engineering Tactics

Evolution of BazarCall Social Engineering Tactics By Daksh Kapur · October 6, 2022 What is BazarCall? As nicely defined in this article by Microsoft: BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s ...

Medtronic's MiniMed 600 series insulin pumps potentially at risk of compromise, says FDA

The US FDA Food and Drug Administration has warned users of Medtronic's MiniMed 600 Series Insulin Pump System--specifically, models for MiniMed 630G and MiniMed 670G--that their medical devices have a cybersecurity issue with its communication protocol. If compromised, attackers could gain...

How to check what VDAs are registered to a DDC

List of VDAs registered to a DDC...

XLL_Phishing - XLL Phishing Tradecraft

With Microsoft's recent announcement regarding the blocking of macros in documents originating from the internet email AND web download, attackers have began aggressively exploring other options to achieve user driven access UDA. There are several considerations to be weighed and balanced when...

Fortinet FortiADC Licensing Issue Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. Fortinet FortiADC is vulnerable to an authorization issue, which stems from improper privilege management. An attacker could exploit the vulnerability to modify system files using a shell...

CVE-2022-36088

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or...

Default configuration

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or...

The vulnerability of the kvm_irq_delivery_to_apic_fast() function in the KVM virtualization subsystem of the Linux operating system allows a attacker to trigger a service failure.

The vulnerability of the kvmirqdeliverytoapicfast function in the KVM virtualization subsystem of the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2022-25641

Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsing within signed documents. This leads to delivery of incorrect signature information via an Incremental Saving Attack and a Shadow Attack...

Cross site scripting

Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsing within signed documents. This leads to delivery of incorrect signature information via an Incremental Saving Attack and a Shadow Attack...

Researchers Detail Evasive DarkTortilla Crypter Used to Deliver Malware

A .NET-based evasive crypter named DarkTortilla has been used by threat actors to distribute a broad array of commodity malware as well as targeted payloads like Cobalt Strike and Metasploit, likely since 2015. "It can also deliver 'add-on packages' such as additional malicious payloads, benign...

Malicious Package

Overview plutos is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a Discord...

Malicious Package

Overview cyphers is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a Discord...

Malicious Package

Overview hackerfilelol is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a...

Malicious Package

Overview pippytest is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a Disco...

Malicious Package

Overview hackerfileloll is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a...

Malicious Package

Overview stealthpy is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a Disco...

GitHub Dependabot Now Alerts Developers On Vulnerable GitHub Actions

Cloud-based code hosting platform GitHub has announced that it will now start sending Dependabot alerts for vulnerable GitHub Actions to help developers fix security issues in CI/CD workflows. "When a security vulnerability is reported in an action, our team of security researchers will create an...

CVE-2022-20869

CVE-2022-20869 affects Cisco BroadWorks Application Delivery Platform Software, specifically its web-based management interface. The vulnerability is a cross-site scripting flaw caused by insufficient input validation, allowing an unauthenticated, remote attacker to persuade a user to click a cra...

The vulnerability in the web interface of Cisco BroadWorks Application Delivery Platform allows a attacker to perform XSS attacks.

The vulnerability in the web interface of the Cisco BroadWorks Application Delivery Platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...