APT28 Exploits Known Vulnerability To Carry Out Reconnaissance and Deploy Malware on Cisco Routers

NCSClink is external, NSA, CISA, and FBI have released a joint advisory to provide details of tactics, techniques, and procedures TTPs associated with APT28's exploitation of Cisco routers in 2021. By exploiting the vulnerability CVE-2017-6742link is external, APT28 used infrastructure to...

Pakistan-Origin SideCopy Linked to New Cyberattack on India's Ministry of Defence

An advanced persistent threat APT group that has a track record of targeting India and Afghanistan has been linked to a new phishing campaign that delivers Action RAT. According to Cyble, which attributed the operation to SideCopy , the activity cluster is designed to target the Defence Research...

Design/Logic Flaw

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

Online Employee Leave Management System跨站请求伪造漏洞

Online Employee Leave Management System is an employee leave management system that provides an employee and management platform to efficiently manage leave departures and approvals. The vulnerability can be exploited by attackers to disguise user identity and send malicious requests...

GHSA-R7J4-82XW-8M9P Plone allows a user to masquerade as a group

Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."...

Plone allows a user to masquerade as a group

Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."...

CVE-2021-44664

An Authenticated Remote Code Exection RCE vulnerability exists in Xerte through 3.9 in websitecode/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files...

OnionShare 授权问题漏洞

OnionShare is an open source tool used to securely and anonymously share files, host websites and chat with friends using the Tor network. Used to securely and anonymously share files, host websites, and chat with friends using the Tor network, a security vulnerability exists in OnionShare that...

OPPO ColorOS 安全漏洞

OPPO ColorOS is a suite of Android-based operating systems for mobile devices from China's OPPO Guangdong Mobile Communications OPPO. ColorOS suffers from a security vulnerability that stems from ColorOS pre-granting dangerous permissions to applications listed in a whitelisted xml named...

Authentication Bypass

Overview Affected versions of this package are vulnerable to Authentication Bypass when a password's salt is unknown. If the secret key base variable is somehow leaked, an attacker can become any user by misusing the masquerade back functionality of this Devise extension, something that is not...

Alexandr Korsak Devise Masquerade has an unspecified vulnerability

Alexandr Korsak Devise Masquerade is a library of utilities from the Spanish company Alexandr Korsak. Alexandr Korsak Devise Masquerade is a security vulnerability that could be exploited by attackers to emulate any user on the site...

CVE-2021-28680

The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...

CVE-2021-28680

CVE-2021-28680 concerns the devise_masquerade gem prior to 1.3. The vulnerability allows an attacker to impersonate a target user by manipulating the session cookie and choosing the destination user, without needing that user’s password salt. This weakens a masquerading feature in deployments tha...

Devise Masquerade安全漏洞

Alexandr Korsak Devise Masquerade is a library of utilities from the Spanish company Alexandr Korsak. Alexandr Korsak Devise Masquerade is a security vulnerability that could be exploited by attackers to emulate any user on the site...

kernel: Forwarding EAPOL from unauthenticated wifi client

Frames used for authentication and key management between the AP and connected clients. Some clients may take these redirected frames masquerading as control mechanisms from the AP...

Cross-site Scripting (XSS) - Stored in aces/loris

✍️ Description Cross-site scripting also known as XSS is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, to carry out...

CVE-2021-3636

OpenShift OpenShift before 4.8 includes an in-cluster Service CA certificate that incorrectly contains additional CA certificates. This allows an attacker who compromising any of those extra CAs to masquerade as a trusted in-cluster service, enabling potential impersonation of in-cluster services...

Consul’s Envoy TLS Configuration Did Not Validate Destination Service Subject Alternative Names

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that the Envoy proxy configuration for Consul Connect does not mutually verify the destination service identity. This vulnerability, CVE-2021-32574, affects Consul versions 1.3.0 up to 1.10.0, and is fixed in the...

CVE-2021-3636

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificate...