CVE-2024-20380

Summary: CVE-2024-20380 is a DoS in ClamAV’s HTML parser triggered by a crafted HTML file scanned by the unauthenticated attacker. The root cause is tied to the C-to-Rust FFI boundary in the HTML parser, leading to a crash of the clamd/scan process and a denial of service. Affected product/versio...

FIN7 Cybercrime Group Targeting U.S. Auto Industry with Carbanak Backdoor

The infamous cybercrime syndicate known as FIN7 has been linked to a spear-phishing campaign targeting the U.S. automotive industry to deliver a known backdoor called Carbanak aka Anunak. "FIN7 identified employees at the company who worked in the IT department and had higher levels of...

CVE-2024-26899 block: fix deadlock between bd_link_disk_holder and partition scan

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bdlinkdiskholder and partition scan 'openmutex' of gendisk is used to protect open/close block devices. But in bdlinkdiskholder, it is used to protect the creation of symlink between holding disk and...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a deadlock issue between bdlinkdiskholder and partition scanning...

clamav -- Possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition

Błażej Pawłowski reports: A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400 Exploit Tool 🛠️ This Python script is designed...

GHSA-QH6X-J82H-VPF9 gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183 SSRF Vulnerability in gradio-app/gradio

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

WordPress 6.5.x < 6.5.2 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Importance of Scanning Files on Uploader Applications

Delve into the crucial practice of file scanning within uploader applications, and learn defensive measures to safeguards against malicious threats like malware...

Open Information Security Foundation Suricata Installed (Windows)

Binary data oisfsuricatawininstalled.nbin...

clamav:clamav_scanfile_HTML_fuzzer: Crash in cli_html_normalise

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=5417993613934592 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavscanfileHTMLfuzzer Job Type: libfuzzerubsanclamav Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

CloudGrappler - A purpose-built tool designed for effortless querying of high-fidelity and single-event detections related to well-known threat actors in popular cloud environments such as AWS and Azure

Permiso: https://permiso.io Read our release blog: https://permiso.io/blog/cloudgrappler-a-powerful-open-source-threat-detection-tool-for-cloud-environments CloudGrappler is a purpose-built tool designed for effortless querying of high-fidelity and single-event detections related to well-known...

Exploit for Command Injection in Dlink Dns-320L_Firmware

🛠️ CVE-2024-3273 Exploit Tool 🌟 Introduction This script...

SuperSize Me

SuperSize Me By Floser Bacurio Jr., Bernadette Canubas, Michaelo Oliveros · April 02, 2024 Introduction Cyber attackers are always finding new ways to outsmart security systems and distribute malware effectively. We discovered an interesting detection evasion technique of delivering archive files...

Introducing New Pricing For Wordfence CLI!

We have an exciting announcement today about the Wordfence CLI project. We launched Wordfence CLI at WordCamp US back in August of 2023 with the goal of bringing malware and vulnerability scanning to the command line. Weve been working closely with our customers since the launch to better...

Securing your home network is long, tiresome, and entirely worth it, with Carey Parker: Lock and Code S05E07

This week on the Lock and Code podcast… Few words apply as broadly to the public—yet mean as little—as “home network security.” For many, a “home network” is an amorphous thing. It exists somewhere between a router, a modem, an outlet, and whatever cable it is that plugs into the wall. But the id...

Sr2T - Converts Scanning Reports To A Tabular Format

Scanning reports to tabular sr2t This tool takes a scanning tool's output file, and converts it to a tabular format CSV, XLSX, or text table. This tool can process output from the following tools: 1. Nmap XML; 2. Nessus XML; 3. Nikto XML; 4. Dirble XML; 5. Testssl JSON; 6. Fortify FPR. Rationale...