260 matches found
Mimir - Smart OSINT Collection Of Common IOC Types
Smart OSINT collection of common IOC types. Overview This application is designed to assist security analysts and researchers with the collection and assessment of common IOC types. Accepted IOCs currently include IP addresses, domain names, URLs, and file hashes. The title of this project is nam...
Nice Try: 501 (Ransomware) Not Implemented
An Ever-Evolving Threat Since January 10, 2020, FireEye has tracked extensive global exploitation of CVE-2019-19781, which continues to impact Citrix ADC and Gateway instances that are unpatched or do not have mitigations applied. We previously reported on attackers’ swift attempts to exploit thi...
"Cablehaunt" Cable Modem WebSocket DoS
There exists a buffer overflow vulnerability in certain Cable Modem Spectrum Analyzer interfaces. This overflow is exploitable, but since an exploit would differ between every make, model, and firmware version which also differs from ISP to ISP, this module simply causes a Denial of Service to te...
TheTHE - Simple, Shareable, Team-Focused And Expandable Threat Hunting Experience
TheTHE is an environment intended to help analysts and hunters over the early stages of their work in an easier, unified and quicker way. One of the major drawbacks when dealing with a hunting is the collection of information available on a high number of sources, both public and private. All thi...
Threat Analysis Unit (TAU) Threat Intelligence Notification: Cyborg Ransomware
Cyborg Ransomware was found being distributed via spear-phishing email campaign which contains a fake “Windows Update” email which appears as a ‘.jpg’ file in the email attachment, but is instead a ‘.exe’ binary file. It tries to tempt users to click on the malicious attachment file in order to...
Threat Roundup for September 27 to October 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 27 and Oct. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...
Directory Traversal
tapestry-ioc is vulnerable to directory traversal. The \ character is not filtered when the library is used on a Windows platform, allowing an attacker to perform a path traversal attack to read arbitrary files...
Threat Roundup for August 16 to August 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 16 and Aug. 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...
Threat Roundup for August 9 to August 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 9 and Aug. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
Redis Unauthenticated Code Execution Exploit
This Metasploit module can be used to leverage the extension functionality added by Redis 4.x and 5.x to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis which called replication between master and slave. This module requires Metasploit:...
CB TAU Threat Intelligence Notification: Maze Ransomware
Maze Ransomware, also known as ChaCha Ransomware, has been discovered being distributed by the Fallout exploit kit. After the encryption, it will create a ransom note named ‘DECRYPT-FILES.html’ in each of the encrypted file’s folders. The bottom of the ransom note is a base64 string which contain...
CVE-2019-4068
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...
CVE-2019-4066
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...
CVE-2019-4070
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...
Code injection
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...
CVE-2019-4066
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...
CVE-2019-4070
IBM Intelligent Operations Center (IOC) versions 5.1.0–5.2.0 are vulnerable to cross-site scripting due to insufficient input sanitization in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions in...
CVE-2019-4066
IBM IOC CVE-2019-4066 affects IBM Intelligent Operations Center (IOC) 5.1.0–5.2.0; IOC for Emergency Management 5.1.0–5.1.0.6; and Water Operations for Waternamics 5.1.0–5.2.1.1. An authenticated user can create arbitrary user accounts, causing ID-management issues and potentially enabling code e...
CVE-2019-4070
IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...