Hello! My name is Dtrack

Our investigation into the Dtrack RAT actually began with a different activity. In the late summer of 2018, we discovered ATMDtrack, a piece of banking malware targeting Indian banks. Further analysis showed that the malware was designed to be planted on the victim's ATMs, where it could read and...

GDB Debugger Code Execution

The vulnerability of the GDB debugger’s gdb module relates to the execution of an operation outside the buffer in memory. Exploiting this vulnerability allows a perpetrator to execute arbitrary code or trigger a service failure using a specially created ELF file...

CVE-2019-13534

Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part : M8096-67501, WLAN Version B, Firmware A.01.09, Part : N/A Replaced by Version C and WLAN Version B, Firmware A.01.09, Part : N/A Replaced by Version C. The product...

CVE-2019-13534: Download of Code Without Integrity Check

Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part : M8096-67501, WLAN Version B, Firmware A.01.09, Part : N/A Replaced by Version C and WLAN Version B, Firmware A.01.09, Part : N/A Replaced by Version C. The product...

Joker Spyware Found in 24 Google Play Apps

A new spyware has been making the rounds in Android apps on Google Play, infecting victims post-download to steal their SMS messages, contact lists and device information. In addition to stealing victims’ information, the malware also stealthily signs them up for premium service subscriptions tha...

Command injection

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile profile.php?cmd=download, is executed as root via a...

Bitbucket 6.1.1 Path Traversal to RCE

Impact In Bitbucket the four different user roles Bitbucket User, Project Creator, Admin and System Admin exist. An attacker with the permissions of the role Admin can abuse Bitbuckets Data Center Migration tool to drop an executable shell script in an arbitrary directory. This is caused by a...

Amazon Linux 2 : libvirt (ALAS-2019-1274) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. CVE-2019-11091 Modern Intel microprocessors implement hardware-level micro-optimizations to improve the...

Sogou Input Method Exe Hijacking Vulnerability

Sogou Input Method is a Chinese character input method tool. Sogou Input Method suffers from an exe hijacking vulnerability, which can be exploited by attackers to run malicious files during update checks...

CVE-2019-15501

Reflected cross site scripting XSS in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter...

PEpper - An Open Source Script To Perform Malware Static Analysis On Portable Executable

An open source tool to perform malware static analysis on P ortable E xecutable Installation eva@paradise:$ git clone https://github.com/Th3Hurrican3/PEpper/ eva@paradise:$ cd PEpper eva@paradise:$ pip3 install -r requirements.txt eva@paradise:$ python3 pepper.py ./malwaredir Screenshot...

libdwarf Heap Buffer Overflow DoS

The vulnerability of the dwarfelfloadheaders.c component in the library that provides access to debugging information in DWARF libdwarf is related to zero-division errors. Exploiting this vulnerability could allow a malicious actor to cause service failures using an ELF file...

CVE-2019-5631

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system who must already be authenticated to the operating system can elevate their privileges with this vulnerability to the privilege level ...

CVE-2019-15130

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitmentonline/personalData/actpersonaltab.cfm multiple-part POST request with a predictable WRC01USERID...

Pulse Secure Pulse Connect Secure SSL VPN Unauthenticated Path Traversal (CVE-2019-11510)

Binary data pulseconnectsecurepathtraversal.nbin...

CVE-2019-12808

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

CVE-2019-12808

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

Privilege escalation

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

PT-2019-2990 · Microsoft · Windows Defender

Name of the Vulnerable Software and Affected Versions: Windows Defender affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the MpSigStub.exe file for Defender, allowing file deletion in arbitrary locations. To exploit this, an attacker...

FortiOS Access Control Code Execution

The vulnerability of the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a person with administrator privileges to execute arbitrary code by creating a symbolic link to an executable file in the “/bin/” directory...