CVE-2023-36013

PowerShell Information Disclosure Vulnerability...

CVE-2023-36013

CVE-2023-36013 is a PowerShell information-disclosure vulnerability with a CVSS v3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Several connected advisories document affected environments and versions. In macOS (Photon/Tenable Nessus NASL entries), Microsoft PowerShell 7.2.x is vulnera...

CVE-2023-36013 PowerShell Information Disclosure Vulnerability

...

NetSupport RAT Infections on the Rise - Targeting Government and Business Sectors

Threat actors are targeting the education, government and business services sectors with a remote access trojan called NetSupport RAT. "The delivery mechanisms for the NetSupport RAT encompass fraudulent updates, drive-by downloads, utilization of malware loaders such as GHOSTPULSE, and various...

PowerShell Information Disclosure Vulnerability

...

Explanation of Delivery Group power management for single session

Explain the detail difference between"Machines to be powered on" in delivery group and "PeakBufferSizePercent" in DDC powershell SDK, when control the power management for pool random delivery groupor unassigned machines...

Microsoft Windows PowerShell Security Vulnerability

Microsoft Windows PowerShell is a command line shell program and scripting environment from Microsoft that enables command line users and script writers to leverage the power of . A security vulnerability exists in Microsoft Windows PowerShell that originates from an information disclosure...

PT-2023-7432 · Microsoft +1 · Windows Powershell +1

Name of the Vulnerable Software and Affected Versions: Windows PowerShell affected versions not specified Description: The vulnerability is related to errors in the authentication procedure of the Windows operating system's PowerShell interpreter. Exploitation of this issue may allow a remote...

Vietnamese Hackers Using New Delphi-Powered Malware to Target Indian Marketers

The Vietnamese threat actors behind the Ducktail stealer malware have been linked to a new campaign that ran between March and early October 2023, targeting marketing professionals in India with an aim to hijack Facebook business accounts. "An important feature that sets it apart is that, unlike...

Description of the security update for Microsoft Exchange Server 2016: November 14, 2023 (KB5032147)

None None...

AjaxPro Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AjaxPro Deserialization Remote Code Execution', 'Description' = %q This module leverages an insecure deserialization of data to get remote code...

How to check whether Citrix Licensing is in Grace Period using PowerShell?

This article describes how to use PowerShell cmdlets to check whether Citrix Licensing is in grace period and the number of hours remaining in the grace period...

Update now! SysAid vulnerability is actively being exploited by ransomware affiliate

Users of SysAid on-premises should take action to deal with a vulnerability. SysAid is a widely used IT service management solution that allows IT teams to manage tasks. Microsoft discovered an ongoing exploitation of a zero-day vulnerability in the SysAid IT support software in limited attacks b...

MuddyC2Go: New C2 Framework Iranian Hackers Using Against Israel

Iranian nation-state actors have been observed using a previously undocumented command-and-control C2 framework called MuddyC2Go as part of attacks targeting Israel. "The framework's web component is written in the Go programming language," Deep Instinct security researcher Simon Kenin said in a...

Dvenom - Tool That Provides An Encryption Wrapper And Loader For Your Shellcode

Double Venom DVenom is a tool that helps red teamers bypass AVs by providing an encryption wrapper and loader for your shellcode. Capable of bypassing some well-known antivirus AVs. Offers multiple encryption methods including RC4, AES256, XOR, and ROT. Produces source code in C, Rust, PowerShell...

Security Bulletin: IBM Personal Communications could allow a remote user to obtain sensitive information including user passwords, allowing unauthorized access. (CVE-2016-0321)

Summary IBM Personal Communications is susceptible to unauthorized access vulnerability when running on a compromised system by the victim opening a mail with a malicious attachment or visiting a malicious website. Malware could run with user privileges but not necessarily having access to the...

YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group

A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani...

Broker and Central Config Service PowerShell commands failing when run on Cloud Connectors

When attempting to run PowerShell commands on Cloud Connectors, cmdlets may fail with the following error message: Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will...

Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware

CVE-2023-20198-IOS-XE-Scanner Single threaded scanner for...

Stealer for PIX payment system, new Lumar stealer and Rhysida ransomware

Introduction As a cybersecurity company, Kaspersky is constantly dealing with known and brand-new malware samples. As part of our crimeware reporting service, we provide our customers with technical reports on the evolution of existing crimeware families, as well as newly emerging ones. In this...