CVE-2025-32367: Direct Request

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions...

CISA Partners with ASD’s ACSC, CCCS, NCSC-UK, and Other International and US Organizations to Release Guidance on Edge Devices

CISA—in partnership with international and U.S. organizations—released guidance to help organizations protect their network edge devices and appliances, such as firewalls, routers, virtual private networks VPN gateways, Internet of Things IoT devices, internet-facing servers, and internet-facing...

Tackling AI threats. Advanced DFIR methods and tools for deepfake detection

TL; DR AI-generated documents, videos and more pose significant challenges for DFIR DFIR teams can harness innovative detection strategies and tooling Digital fingerprinting and watermarking, AI-powered and behavioural analyses Hardware-based forensics and image-specific forensic techniques...

What Graykey Can and Can’t Unlock

This is from 404 Media: The Graykey, a phone unlocking and forensics tool that is used by law enforcement around the world, is only able to retrieve partial data from all modern iPhones that run iOS 18 or iOS 18.0.1, which are two recently released versions of Apple's mobile operating system,...

Kubernetes Audit Log “Gotchas”

How to overcome challenges and security gaps when using K8s audit logs for forensics and attack detection...

io.jenkins.plugins:forensics-api (2.4.0), io.jenkins.plugins:warnings-ng (11.0.0) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3853.vb_a_490d892963)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3853.vba490d892963 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:forensics-api 2.4.0 -...

io.jenkins.plugins:forensics-api (>=2.5.0, <=2.7.0), io.jenkins.plugins:warnings-ng (>=11.4.0, <=11.7.0) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3903.v48a_8836749e9)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3903.v48a8836749e9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:forensics-api =2.5.0, =11.4.0, =11.7.0...

io.jenkins.blueocean:blueocean-rest-impl (>=1.27.4, <=1.27.5.1), io.jenkins.plugins:cdevents (>=v0.1.0-draft6-16.v8ca_10874de34, <=1-24.v0250517580b_2) +6 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3659.v582dc37621d8)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3659.v582dc37621d8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-rest-impl =1.27.4,...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.12, <=1.27.16), io.jenkins.plugins:coverage (>=1.11.0, <=1.16.1) +6 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1305.v487433146192)

org.jenkins-ci.plugins:script-security MAVEN version 1305.v487433146192 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.12, =1.11.0,...

Mounting memory with MemProcFS for advanced memory forensics

Mounting memory? This changes everything! TL;DR Memory forensics is crucial for investigations, providing access to volatile data, like running processes and network connections. MemProcFS is a game-changer tool in memory forensics, allowing memory dumps to be mounted and browsed like file system...

Using Volatility for advanced memory forensics

TL;DR Memory forensics enhances investigations by analysing volatile data in RAM unavailable in disk forensics. Key insights from memory include running processes , network connections , encryption keys , and user activity , vital for real-time investigations. Smaller memory images 4-32 GB offer...

CVE-2024-45412

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-45412

The CVE-2024-45412 entry affects Yeti Platform versions prior to 2.1.11. The vulnerability arises from remote user-controlled data tags undergoing Unicode normalization with the NFKD form, which on Windows can be resource-intensive and lead to denial of service, potentially exacerbated by large p...

A deep dive into the most interesting incident response cases of last year

In 2023, Kasperskys Global Emergency Response Team GERT participated in services around the world that allowed our experts to gain insight into various threats and techniques used by APT groups, common crimeware and, in some cases, internal adversaries. As we highlighted in our annual report, the...

CVE-2024-7448 Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must...

CVE-2024-7448

CVE-2024-7448 affects Magnet Forensics AXIOM’s Android device image acquisition component. The flaw arises from improper validation of a user-supplied string prior to using it in a system call, enabling a network-adjacent attacker to execute arbitrary code with the current user’s privileges. Expl...

CVE-2024-7448 Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must...

CVE-2024-7448: Improper Neutralization of Special Elements used in an OS Command

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must...

PT-2024-38358

Name of the Vulnerable Software and Affected Versions Magnet Forensics AXIOM affected versions not specified Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the Android device image acquisition functionality due ...