7738 matches found
Announcing the Microsoft Identity Research Project Grant
We are excited to announce the Microsoft Identity Research Project Grant a new opportunity in partnership with the security community to help protect Microsoft customers. This project grant awards up to $75,000 USD for approved research proposals that improve the security of the Microsoft Identit...
Announcing the Microsoft Identity Research Project Grant
We are excited to announce the Microsoft Identity Research Project Grant a new opportunity in partnership with the security community to help protect Microsoft customers. This project grant awards up to $75,000 USD for approved research proposals that improve the security of the Microsoft Identit...
The Curious Case of WebCrypto Diffie-Hellman on Firefox - Small Subgroups Key Recovery Attack on DH
tl;dr Mozilla Firefox prior to version 72 suffers from Small Subgroups Key Recovery Attack on DH in the WebCrypto 's API. The Firefox's team fixed the issue removing completely support for DH over finite fields that is not in the WebCrypto standard. If you find this interesting read further below...
Exploit for CVE-2013-0422
K8tools 20191130 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 下载: https://github.com/k8gege/K8tools PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 扫描工具 Ladon 5.7 大型内网渗透扫描神器内置40个功能,支持Cobalt Strike + 扫描工具 K8Cscan5.4 大型内网渗透扫描器内置30个功能,支持Cobalt Strike +...
AVCLASS++ - Yet Another Massive Malware Labeling Tool
AVCLASS++ is an appealing complement to AVCLASS 1, a state-of-the-art malware labeling tool. Overview AVCLASS++ is a labeling tool for creating a malware dataset. Addressing malware threats requires constant efforts to create and maintain a dataset. Especially, labeling malware samples is a vital...
handbook.spherestandards.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1054780 Security Researcher passc0de Helped patch 22 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting handbook.spherestandards.org website and its users...
Exploit for Code Injection in Vbulletin
Mass-Pwn-vBulletin Identify vulnerable RCE vBulletin 5.0.0 -...
Apple's Bug Bounty Opens for Business, $1M Payout Included
Apple has officially opened its historically private bug-bounty program to the public, while boosting its top payout to $1 million. Bounty hunters seeking that $1 million will need to provide a working exploit for a zero-click remote chain with full kernel execution and persistence on Apple’s...
XnView 2.49.1 Denial Of Service
Exploit Title: XnView 2.49.1 - 'Research' Denial of Service PoC Exploit Author : ZwX Exploit Date: 2019-12-17 Vendor Homepage : http://www.xnview.com Link Software : https://www.xnview.com/fr/xnview/downloads Tested on OS: Windows 7 ''' Proof of Concept PoC: ======================= 1.Download and...
XnView 2.49.1 - (Research) Denial of Service Exploit
Exploit Title: XnView 2.49.1 - 'Research' Denial of Service PoC Exploit Author : ZwX Vendor Homepage : http://www.xnview.com Link Software : https://www.xnview.com/fr/xnview/downloads Tested on OS: Windows 7 ''' Proof of Concept PoC: ======================= 1.Download and install XnView 2.Open th...
dbgidoon.ac.in Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1040401 Security Researcher Codingboy Helped patch 14 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting dbgidoon.ac.in website and its users. Following...
Finding a common language to describe AI security threats
As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...
VMware Carbon Black TAU Threat Research: Visualizing Ransomware with MITRE ATT&CK
If no one had ever heard of ransomware prior to May 2017, then one thing that is fairly certain is that the WannaCry ransomware outbreak unquestionably put ransomware on the security radar, and sent shivers up CISO’s and analysts’ spines for the weeks and months that followed. Only a few weeks...
Threat Source newsletter (Dec. 12, 2019)
Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We’re entering our Year in Review period. Now’s the time to look back on the top stories from 2019 and think about what we learned. In t...
Talos Vulnerability Discovery Year in Review — 2019
By Martin Zeiser. Cisco Talos' Systems Security Research Team investigates software, operating system, IoT and ICS vulnerabilities to make sure we find vulnerabilities before the bad guys do. We provide this information to the affected vendors so that they can create patches and protect their...
CVE-2019-11157
Improper conditions check in voltage settings for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access...
designresearch.aalto.fi Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1033611 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Exploit for Path Traversal in Ivanti Connect_Secure
pulsexploit Automated script for Pulse Secure SSL VPN exploit...
New Linux Bug Lets Attackers Hijack Encrypted VPN Connections
A team of cybersecurity researchers has disclosed a new severe vulnerability affecting most Linux and Unix-like operating systems, including FreeBSD, OpenBSD, macOS, iOS, and Android, that could allow remote 'network adjacent attackers' to spy on and tamper with encrypted VPN connections. The...
Hacking Hardware Password Managers: The RecZone
TL:DR Hardware security can be difficult to fathom, so I set out to research three password vaults as a newbie, sharing my findings. I picked three popular hardware vaults, each with different components, requiring different skills and equipment. Here's how I learned about disassembly, chipset...