Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers

The threat actor behind the SolarWinds supply chain attack has been linked to yet another "highly targeted" post-exploitation malware that could be used to maintain persistent access to compromised environments. Dubbed MagicWeb by Microsoft's threat intelligence teams, the development reiterates...

PT-2022-23712 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform versions 2022.3 and previous Description: The issue is related to insufficient control on a URL parameter, causing an insecure direct object reference IDOR vulnerability. This allowed users with Node Management rights to...

Russian Hackers Using DropBox and Google Drive to Drop Malicious Payloads — The Hacker News

The Russian state-sponsored hacking collective known as APT29 has been attributed to a new phishing campaign that takes advantage of legitimate cloud services like Google Drive and Dropbox to deliver malicious payloads on compromised systems. "These campaigns are believed to have targeted several...

Attacks on Managed Service Providers Expected to Increase

CISA, NSA, FBI, and similar organizations in the other Five Eyes countries are warning that attacks on MSPs--as a vector to their customers--are likely to increase. No details about what this prediction is based on. Makes sense, though. The SolarWinds attack was incredibly successful for the...

SolarWinds Serv-U FTP Server 访问控制错误漏洞

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from SolarWinds Corporation, USA. A security vulnerability exists in SolarWinds Serv-U FTP Server 15.3 and prior versions, which stems from the presence of improper access control in the application. An unauthorized...

SolarWinds Database Performance Monitor 跨站脚本漏洞

SolarWinds Database Performance Monitor is a database performance monitoring and optimization software from SolarWinds USA. A security vulnerability exists in SolarWinds Database Performance Monitor 2022.1.7779, no information about this vulnerability is available at this time, please stay tuned ...

A Sinister Way to Beat Multifactor Authentication Is on the Rise

Lapsus$ and the group behind the SolarWinds hack have utilized prompt bombing to defeat weaker MFA protections in recent months...

SolarWinds Web Help Desk Installed (Windows)

Binary data solarwindswebhelpdeskinstalled.nbin...

CVE-2021-35254

SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future...

Input validation

SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future...

CVE-2021-35254 Authenticated Remote Code Execution in WebHelpDesk 12.7.8

SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future...

CVE-2021-35254

CVE-2021-35254 affects SolarWinds WebHelpDesk (12.7.8 and earlier). The issue stems from an input that was not sanitized/validated, enabling exploitation. Public records describe this as an authenticated remote code execution risk. SolarWinds mitigated by removing the vulnerable input field to pr...

Solarwinds Web Help Desk 安全漏洞

SolarWinds Web Help Desk is a suite of help desk and asset management software from SolarWinds USA. The software supports features such as centralized knowledge base, IT asset management, project and task management. A security vulnerability exists in SolarWinds Web Help Desk 12.7.8 and prior...

SolarWinds Web Help Desk - Web Detection

Binary data solarwindswebhelpdeskdetect.nbin...

SolarWinds Orion Platform 2020.2.0 < 2020.2.4

The version of SolarWinds Orion Platform installed on the remote host is prior to 2020.2.4. It is, therefore, affected by a vulnerability as referenced in the orionplatform202024 advisory. - This vulnerability allows remote attackers to execute escalate privileges on affected installations of...

Google Buys Cybersecurity Firm Mandiant for $5.4 Billion

Google is officially buying threat intelligence and incident response company Mandiant in an all-cash deal approximately valued at $5.4 billion, the two technology firms announced Tuesday. Mandiant is expected to be folded into Google Cloud upon the closure of the acquisition, which is slated to...

Solarwinds Web Help Desk 信息泄露漏洞

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and other features. Solarwinds Web Help Desk suffers from an information disclosure vulnerability...

SolarWinds Serv-U FTP Server 路径遍历漏洞

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds. A path traversal vulnerability exists in SolarWinds Serv-U FTP Server. The vulnerability arises from a failure of a network system or product to properly filter special elements in the path...

Toyota to Close Japan Plants After Suspected Cyberattack

What was potentially a cyberattack hit one of Toyota’s parts suppliers, causing the company to move to shut down about a third of the company’s global production tomorrow, the company announced on Monday. Toyota doesn’t know how long the 14 plants will be unplugged. The closure will mean that the...

SolarWinds Orion Platform Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of alert creation. The issue results from the lack of proper validati...