Beers with Talos, Ep. #108: Kaseya it ain't so

Beers with Talos BWT Podcast episode No. 108 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. Who needed a summer vacation anyway? The whole Beers... This is only the...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-32772

CVE-2021-32772 affects Poddycast, a podcast app built with Electron. The root cause is improper sanitization of HTML in podcast feed data, allowing HTML/JavaScript injection via the feed content. In an Electron-based app, this XSS can be escalated to remote code execution, enabling commands to be...

Threat Source newsletter (July 22, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. I'm compiling this Tuesday for vacation reasons, so apologies for any major stories I'm missing here. This week's Beers with Talos podcast hits the seas again. And although we've covered sea shanties in the past, this... This is on...

Beers with Talos, Ep. #107: Sailing the high seas in search of privateer groups

Beers with Talos BWT Podcast episode No. 107 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. You're not going to believe this, but everyone... This is only the...

What’s Next for REvil’s Victims?

Last week, the servers of ransomware giant REvil vanished. Many applauded as dark-web and clear-web sites used to support the backend infrastructure of REvil, aka Sodinokibi, as well as to leak victims’ data, slipped offline early Tuesday morning. Not REvil’s victims, though. They’re now stuck,...

WordPress server-side request forgery vulnerability (CNVD-2021-59062)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A server-side request forgery vulnerability exists in the WordPress Podcast Importer SecondLine...

CVE-2020-24149

Server-side request forgery SSRF in the Podcast Importer SecondLine podcast-importer-secondline plugin 1.1.4 for WordPress via the podcastfeed parameter in a secondlineimportinitialize action to the secondlinepodcastimport page...

CVE-2020-24149

Server-side request forgery SSRF in the Podcast Importer SecondLine podcast-importer-secondline plugin 1.1.4 for WordPress via the podcastfeed parameter in a secondlineimportinitialize action to the secondlinepodcastimport page...

Server side request forgery (ssrf)

Server-side request forgery SSRF in the Podcast Importer SecondLine podcast-importer-secondline plugin 1.1.4 for WordPress via the podcastfeed parameter in a secondlineimportinitialize action to the secondlinepodcastimport page...

CVE-2020-24149

Server-side request forgery SSRF in the Podcast Importer SecondLine podcast-importer-secondline plugin 1.1.4 for WordPress via the podcastfeed parameter in a secondlineimportinitialize action to the secondlinepodcastimport page...

CVE-2020-24149

CVE-2020-24149 affects the WordPress Podcast Importer SecondLine plugin, version 1.1.4. The vulnerability is a Server-Side Request Forgery (SSRF) via the podcast_feed parameter in the secondline_import_initialize action to the secondlinepodcastimport page. Multiple sources (NVD, WPVulnDB, Patchst...

WordPress Plugin Podcast Importer SecondLine 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A server-side request forgery vulnerability exists in the WordPress Podcast Importer SecondLine...

Racing against a real-life ransomware attack, with Ski Kacoroski: Lock and Code S02E12

At 11:37 pm on the night of September 20, 2019, cybercriminals launched a ransomware attack against Northshore School District in Washington state. Early the next morning, Northshore systems administrator Ski Kacoroski arrived on scene. As Kacoroski soon found out, he and his team were on a race...

Beers with Talos, Ep. #106: Is more than executive action in order?

Beers with Talos BWT Podcast episode No. 106 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded May 20, 2021. Craig wins... This is only the...

Shining a light on dark patterns with Carey Parker: Lock and Code S02E09

This week on Lock and Code, we speak to cybersecurity advocate and author Carey Parker about "dark patterns," which are subtle tricks online to get you to make choices that might actually harm you. Dark patterns have been around for years, and the tricks theyre based on are even older. Ever bough...

Beers with Talos Ep. #104: Supply chain has Matt hopping mad like a kangaroo

Beers with Talos BWT Podcast episode No. 104 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded March 30,... This is only the beginning! Please vis...

Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting (XSS)

Exploit Title: Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting XSS Date: 13/05/2021 Exploit Author: Ayşenur KARAASLAN Vendor Homepage: https://podcastgenerator.net/demoV2/ Software Link: https://podcastgenerator.net/download and...

Podcast Generator 3.1 Cross Site Scripting

Exploit Title: Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting XSS Date: 13/05/2021 Exploit Author: Ayşenur KARAASLAN Vendor Homepage: https://podcastgenerator.net/demoV2/ Software Link: https://podcastgenerator.net/download and...