2020 Cybersecurity Outlook Report

In case you missed it, we are excited to release our latest report from the VMware Carbon Black Threat Analysis Unit TAU, the “2020 Cybersecurity Outlook Report”. In the search for clarity in the modern attacker vs. defender battle, it’s all about behaviors. More broadly, we explore the age-old...

Joplin Desktop 1.0.184 - Cross-Site Scripting

Exploit Title: Joplin Desktop 1.0.184 - Cross-Site Scripting Exploit Author: Javier Olmedo Date: 2020-02-27 Vendor: Laurent Cozic Software Link: https://github.com/laurent22/joplin/archive/v1.0.184.zip Affected Version: 1.0.184 and before Patched Version: 1.0.185 Category: Remote Platform: Window...

New CWE List of Common Security Weaknesses

MITRE has released version 4.0 of the community-developed Common Weakness Enumeration CWE list. Previous CWE list versions describe common software security weaknesses. With version 4.0, the CWE list expands to include hardware security weaknesses. Additionally, version 4.0 simplifies the...

Bringing Intrinsic Security to RSA Conference 2020

This year at the RSA Conference, VMware will be highlighting our vision for Intrinsic Security, a safer, more effective security built into the fabric of the various infrastructure control points that are vulnerable to attack endpoint, identity, network, cloud, workload. The VMware Carbon Black...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. The cryptoreport function mishandles resource cleanup on error. A local attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. CVE-2019-19062 ...

Beers with Talos Ep. #71: I Have the Power(Shell)

Beers with Talos BWT Podcast episode No. 71 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Jan. 17, 2020 PowerShell is a frequent flyer in security headlines — a powerful and oft-wielded tool for attacke...

Invoke-APT29: Adversarial Threat Emulation

MITRE recently conducted its second ATT&CK exercise in their ongoing annual series of Endpoint Security Efficacy testing and evaluation. This test focuses on assessing the behavioral capabilities of multiple endpoint security vendors against a simulated adversary, based closely around...

XMLBlueprint 16.191112 - XML External Entity Injection Vulnerability

Exploit Title: XMLBlueprint 16.191112 - XML External Entity Injection Exploit Author: Javier Olmedo Vendor: XMLBlueprint XML Editor Software Link: https://www.xmlblueprint.com/update/download-64bit.exe Affected Version: 16.191112 and before Patched Version: unpatched Category: Local Platform: XML...

UPDATE: MITRE CALDERA 2.5.1

MITRE CALDERA 2.5.1 is now available since the last release – MITRE CALDERA 2.5.0, which was released a couple of days ago. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. Among major changes, what I like is that now...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Snatch Ransomware

During the end of the year 2019, a ransomware named ‘Snatch” was discovered. Snatch ransomware will force Windows to reboot in Safe Mode where most of the software and system drivers will not be running in order to perform the file encryption process. Similar to the other variants of ransomware, ...

UPDATE: MITRE CALDERA 2.5.0

MITRE CALDERA 2.5.0 is now available since the last release - MITRE CALDERA 2.4.0, which was released in the month of December. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. What is MITRE CALDERA? CALDERA is an...

Easy XML Editor 1.7.8 - XML External Entity Injection Vulnerability

Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection Exploit Author: Javier Olmedo Vendor: Richard Wuerflein Software Link: https://www.edit-xml.com/EasyXMLEditor.exe Affected Version: 1.7.8 and before Patched Version: unpatched Category: Local Platform: XML Tested on: Windows 10...

Important: nss

Issue Overview: A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application compiled with nss. While the...

Important: 389-ds-base

Issue Overview: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. CVE-2019-14824 Affected Packages:...

FTPGetter Professional 5.97.0.223 - Denial of Service Exploit

Exploit Title: FTPGetter Professional 5.97.0.223 - Denial of Service PoC Exploit Author: FULLSHADE Vendor Homepage: https://www.ftpgetter.com/ Software Link: https://www.ftpgetter.com/ftpgetterprosetup.exe Version: v.5.97.0.223 Tested on: Windows 7 CVE : N/A...

Medium: oniguruma

Issue Overview: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c.CVE-2019-19246 Affected Packages:...

FTPGetter Professional 5.97.0.223 Denial Of Service

Exploit Title: FTPGetter Professional 5.97.0.223 - Denial of Service PoC Google Dork: N/A Date: 2020-01-03 Exploit Author: FULLSHADE Vendor Homepage: https://www.ftpgetter.com/ Software Link: https://www.ftpgetter.com/ftpgetterprosetup.exe Version: v.5.97.0.223 Tested on: Windows 7 CVE : N/A...

UPDATE: MITRE CALDERA 2.4.0

MITRE CALDERA 2.4.0 is now available! It has been just four months since the release of MITRE CALDERA 2.3.0. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. This release has a lot of new feature, breaking and...

Threat Analysis Unit (TAU) Threat Intelligence Notification: DeathRansom Ransomware

During mid-November, a new ransomware named ‘DeathRansom” was found being distributed. Similar to the other variants of ransomware, it will perform the deletion of volume shadow copies to ensure all the data cannot be restored easily. After the DeathRansom performs file encryption, it will drop...