7061 matches found
Earth Lusca Hackers Aimed at High-Value Targets in Government and Private Sectors
An elusive threat actor called Earth Lusca has been observed striking organizations across the world as part of what appears to be simultaneously an espionage campaign and an attempt to reap monetary profits. "The list of its victims includes high-value targets such as government and educational...
Zooming in on Zero-click Exploits
Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has gained popularity throughout the pandemic. Unlike other video conferencing systems that I have investigated, where one user initiates a call that other users must immediately accept or reject, Zoom calls ar...
Oracle Critical Patch Update Advisory - January 2022
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...
KLA12426 Multiple vulnerabilities in Oracle Java and GraalVM
Multiple vulnerabilities were found in Oracle Java and GraalVM. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. Security bypass vulnerability vulnerability can...
84,000 WordPress Sites Affected by Three Plugins With The Same Vulnerability
On November 5, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “Login/Signup Popup”, a WordPress plugin that is installed on over 20,000 sites. A few days later we discovered the same vulnerability present in two...
WordPress Bugs Exploded in 2021, Most Exploitable
Last year brought forth much more than a Ben Affleck-Jennifer Lopez reunion – analysts found the number of exploitable WordPress plugin vulnerabilities exploded. Researchers from RiskBased Security reported they found the number of WordPress Plugin vulnerabilities rose by triple digits in 2021...
Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries
A study of 16 different Uniform Resource Locator URL parsing libraries has unearthed inconsistencies and confusions that could be exploited to bypass validations and open the door to a wide range of attack vectors. In a deep-dive analysis jointly conducted by cybersecurity firms Claroty and Snyk,...
A Log4j Retrospective Part 2: Data Exfiltration and Remote Code Execution Exploits
Akamai CTO Charlie Gero shows how the Log4j threat surface could extend to unpatchable embedded and IoT devices...
Photon OS 3.0: Binutils PHSA-2022-3.0-0348
An update of the binutils package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0348. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Debian DLA-2875-1 : clamav - LTS security update
The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2875 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network Security...
Photon OS 3.0: Vim PHSA-2022-3.0-0338
An update of the vim package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0338. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'...
Cross-site Scripting (XSS) - DOM in mrdoob/three.js
Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is window.location.hash and sink is iframe.src Proof of Concept 1 Visit...
pocsuite_poc_collect
It is an offensive tool for vulnerability exploitation. The repository appears to be a collection of proof-of-concept PoC exploits for various vulnerabilities, likely created using the Pocsuite framework. Not specified...
What the Rise in Cyber-Recon Means for Your Security Strategy
As we move into 2022, bad actors are ramping up their reconnaissance efforts to ensure more successful and more impactful cyberattacks. And that means more zero-day exploits are on the horizon. When seen through an attack chain such as the MITRE ATT&CK framework, campaigns are frequently discusse...
Hacking-Scripts
Hacking-Scripts - This is...
Mozilla Rust has an unspecified vulnerability (CNVD-2022-03130)
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. version 0.6.0 before Rust simpleasn1 crate 0.6.1 contains a security vulnerability that can be triggered if a remote attacker exploits the vulnerability to provide UTCTime data with a second character larger tha...
ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan
A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan. With ShonyDanza, you can: Obtain IPs based on search criteria Automatically exclude honeypots from the results based on your pre-configured thresholds Pre-configure all IP searches to filte...
Global Cyberattacks from Nation-State Actors Posing Greater Threats
The macro-trend I’m most alarmed by today is the fact that attackers don’t seem to care about getting caught anymore. We have seen an increase in temerity of attacks by nation-states, such as the Russian attack on SolarWinds, and seen their attack tactics shift from targeted, stealthy operations...
vulhub
This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and services. It contains a collection of exploits and tools for identifying and exploiting vulnerabilities in software and systems. The repository includes a variety ...