PT-2022-18339

Name of the Vulnerable Software and Affected Versions Skipper version 0.9.1 Description The issue is related to an arbitrary file upload vulnerability in the file upload module, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Skipper version 0.9.1, at the...

Turla's 'Crutch' Backdoor Leverages Dropbox in Espionage Attacks

Researchers have discovered a previously undocumented backdoor and document stealer, which they have linked to the Russian-speaking Turla advanced persistent threat APT espionage group. The malware, which researchers call “Crutch,” is able to bypass security measures by abusing legitimate tools –...

Razer: Request Smuggling vulnerability due a vulnerable skipper reverse proxy running in the environment.

The tester discovered that a server was using Skipper as a reverse proxy that was not fully patched, allowing a request smuggling vulnerability. We thank the tester for his report and excellent PoC and his patience with the slow response of the engineering team...

skipper-dan.com Cross Site Scripting vulnerability

Security Researcher Implosion Helped patch 1641 vulnerabilities Received 7 Coordinated Disclosure badges Received 29 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting skipper-dan.com website and its users. Following...

Introducing WhiteBear

As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. Much of the contents of that report are reproduced here. WhiteBear is a parallel project or second stage of the Skipper...

Gazer: A New Backdoor Targets Ministries and Embassies Worldwide

Security researchers at ESET have discovered a new malware campaign targeting consulates, ministries and embassies worldwide to spy on governments and diplomats. Active since 2016, the malware campaign is leveraging a new backdoor, dubbed Gazer, and is believed to be carried out by Turla advanced...

CVE-2004-2077: Undefined Security Weakness

Nadeo Game Engine for Nadeo TrackMania and Nadeo Virtual Skipper 3 allows remote attackers to cause a denial of service server crash via malformed data to TCP port 2350, possibly due to long values or incorrect size fields...