SolarMarker Malware Uses Novel Techniques to Persist on Hacked Systems

In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems. Cybersecurity firm...

Researchers Uncover New Iranian Hacking Campaign Targeting Turkish Users

Details have emerged about a previously undocumented malware campaign undertaken by the Iranian MuddyWater advanced persistent threat APT group targeting Turkish private organizations and governmental institutions. "This campaign utilizes malicious PDFs, XLS files and Windows executables to deplo...

iText 安全漏洞

iText is an open source library for creating and manipulating PDF files in Java. It is written by Bruno Lowagie, Paulo Soares and others. iText has a security vulnerability that originates from the iText v7.1.17 component readStreamBytesRaw contains an out-of-memory error that can be exploited by...

Mageia: Security Advisory (MGASA-2014-0447)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2021-0471)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign

This blog was authored by Ankur Saini and Hossein Jazi Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team...

PT-2022-11370

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.17.1 Description The issue may lead to sensitive information disclosure, allowing an unauthorized app without the required MANAGE DOCUMENTS permission to view image thumbnails for images it does not ha...

Microsoft is now disabling Excel 4.0 macros by default

Back in October 2021, Microsoft announced in an email to customers that it planned to disable Excel 4.0 macros by default to protect customers from malicious documents. Last week—after three decades of macro viruses, and three decades of trying to convince every single Excel user individually to...

Adobe Acrobat Reader Dc Input Validation Error Vulnerability

Adobe Acrobat Reader Dc is a Pdf reading tool from the American company Adobe. It is used to reliably view, print and annotate Pdf documents. Adobe Acrobat Reader Dc suffers from an input validation error vulnerability, which stems from inadequate validation of user-supplied input. A remote...

Adobe Acrobat Reader Dc code problem vulnerability

Adobe Acrobat Reader Dc is a Pdf reading tool from Adobe USA. Used to reliably view, print and annotate Pdf documents. Adobe Acrobat Reader Dc has a code issue vulnerability that stems from a NULL pointer dereference error. A remote attacker could use the vulnerability to trick victims into openi...

Microsoft is now disabling Excel 4.0 macros by default

Back in October 2021, Microsoft announced in an email sent to customers that it planned to disable Excel 4.0 macros by default to protect customers from malicious documents. Now, Microsoft says that change has happened. Good news Sometimes good news in the security world comes later than expected...

CVE-2022-23437

There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present withi...

Cross-site Scripting (XSS) - Reflected in pimcore/data-hub

Description pimcore Datahub is vulnerable to Reflected XSS in the Path of Documents, Assets and Objects in the Security Definition tab Steps to reproduce 1.Go to https://demo.pimcore.fun/admin/ and login. 2.In the left menu bar, click the Datahub icon and click on any existing configuration then ...

Kentico Cross-Site Scripting Vulnerability (CNVD-2022-03949)

A cross-site scripting vulnerability exists in Kentico Xperience, an ASP.NET-based content management system CMS from Kentico U.S. The vulnerability stems from the fact that the product's media subsystem does not validate input data. An attacker could cause client-side code execution via XML...

Adobe Acrobat and Reader 资源管理错误漏洞

Adobe Acrobat, a PDF file editing and conversion tool from Adobe, is vulnerable to a resource management error in Adobe Acrobat and Reader, which is caused by a post-release usage error when processing PDF files. A remote attacker could exploit the vulnerability to create a specially crafted PDF...

Adobe Acrobat Reader Dc 缓冲区错误漏洞

Adobe Acrobat Reader Dc is a Pdf reading tool from Adobe. Adobe Acrobat Reader Dc suffers from a buffer error vulnerability that originates from a boundary error when handling untrusted input. An attacker could exploit this vulnerability to create a specially crafted PDF file, trick the victim in...

Adobe Acrobat and Reader 资源管理错误漏洞

Adobe Reader also known as Acrobat Reader is a PDF file reader software developed by Adobe. Adobe Acrobat is a PDF editing software developed by Adobe. Adobe Acrobat/Reader has a resource management error vulnerability, which can be exploited by remote attackers to Creating specially crafted PDF...

Adobe Acrobat Reader Dc 缓冲区错误漏洞

Adobe Acrobat Reader Dc is a Pdf reading tool from the American company Adobe. It is used to reliably view, print and annotate Pdf documents. Adobe Acrobat Reader Dc suffers from a buffer overflow vulnerability, which can be exploited by attackers to trick victims into opening a carefully...

Kentico 跨站脚本漏洞

A cross-site scripting vulnerability exists in Kentico Xperience, an ASP.NET-based content management system CMS from Kentico U.S. The vulnerability stems from the fact that the product's media subsystem does not validate input data. An attacker could cause client-side code execution via XML...

Log4Shell Strategic Response: 5 Practices for Vulnerability Management at Scale

This post is co-authored by Blake Cifelli, Senior Advisory Services Consultant. In today’s cybersecurity world, risks evolve faster than we can remediate them. To meet our goals and become resilient to these fast changes, we need the right balance of automation and human interaction. Enabling rap...