NS-STEALER Utilizes Discord Bots for Covert Exfiltration of Sensitive Data

Summary: A recently discovered Java-based information stealer, named NS-STEALER, employs a Discord bot channel as an EventListener to exfiltrate sensitive data from compromised hosts. This malware is distributed through ZIP archives that disguise themselves as cracked software. Threat Level - Amb...

Malicious code in gothic-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4172096c341848a0f0d8c56be5e72561fe8d9b467aff45b6f1843bc3106a4a01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years

An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been attributed to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021. "UNC3886 has a track record of utilizing...

New Docker Malware Steals CPU for Crypto & Drives Fake Website Traffic

Vulnerable Docker services are being targeted by a novel campaign in which the threat actors are deploying XMRig cryptocurrency miner as well as the 9Hits Viewer software as part of a multi-pronged monetization strategy. "This is the first documented case of malware deploying the 9Hits applicatio...

Ansible Config Gather

This module will grab ansible information including hosts, ping status, and the configuration file. Module Options msf use post/linux/gather/ansible msf postansible show actions ...actions... msf postansible set ACTION msf postansible show options ...show and set options... msf postansible run Th...

CVE-2024-22408

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408 Server-Side Request Forgery (SSRF) in Shopware Flow Builder

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408 Server-Side Request Forgery (SSRF) in Shopware Flow Builder

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408

Shopware Flow Builder has a URL validation issue in the call webhook action that enables SSRF to internal hosts. Affected: Shopware open headless commerce platform (Flow Builder component). Impact: potential unauthorized web requests from authenticated users to internal destinations. Remediation:...

Shopware Code Issues Vulnerabilities

Shopware is a suite of open source e-commerce software from German company Shopware. A code issue vulnerability exists in Shopware versions 6.5.7.3 and earlier, which stems from the Flow Builder functionality not being able to adequately validate request URLs, allowing an attacker to perform web...

PT-2024-19398 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.5.7.4 Shopware version 6.4 Description: The Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to...

Threat Actors Increasingly Abusing GitHub for Malicious Purposes

The ubiquity of GitHub in information technology IT environments has made it a lucrative choice for threat actors to host and deliver malicious payloads and act as dead drop resolvers, command-and-control, and data exfiltration points. "Using GitHub services for malicious infrastructure allows...

Amazon Linux 2 : bluez (ALAS-2024-2386)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2386 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Tenable has...

Malicious code in @serenity-web/channel-motor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2e1f63ab01642f5ad7bc933a823db954af9d0880bc4ef256f32077a9b89b714 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

hosts-deny.eu Improper Access Control vulnerability OBB-3824630

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-7090 Sudo: improper handling of ipa_hostname leads to privilege mismanagement

A flaw was found in sudo in the handling of ipahostname, where ipahostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2023-3499)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and...

Debian DSA-5584-1 : bluez - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5584 advisory. It was reported that the BlueZ's HID profile implementation is not inline with the HID specification which mandates the use of Security Mode 4. The HID profile...

The vulnerability of the Nagios XI monitoring tool, related to unencrypted storage of account data, allows a hacker to manipulate the account data of external hosts by using encrypted Ansible files.

The vulnerability of Nagios XI monitoring tool is related to the unencrypted storage of credentials. Exploiting this vulnerability can allow an attacker to gain unauthorized access to credentials for external hosts from encrypted Ansible files...