555 matches found
Exploit for Double Free in Microsoft
CVE-2025-62215 Exploit PoC Original code credit: https://gith...
EUVD-2015-6523
Malware in sbrugna...
EUVD-2018-0748
Malware in sbrugna...
EUVD-2018-0769
Malware in sbrugna...
EUVD-2017-14504
Malware in sbrugna...
EUVD-2023-0196
Malicious code in bioql PyPI...
MAL-2025-36320 Malicious code in test-mlw2-spray-sized (npm)
The package test-mlw2-spray-sized was found to contain malicious code...
MAL-2025-36319 Malicious code in test-mlw2-spray-merks (npm)
The package test-mlw2-spray-merks was found to contain malicious code...
Malicious code in test-mlw2-spray-sized (npm)
The package test-mlw2-spray-sized was found to contain malicious code...
Malicious code in test-mlw2-spray-merks (npm)
The package test-mlw2-spray-merks was found to contain malicious code...
CVE-2023-41885
Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not...
CVE-2020-5799
The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricted functionality and to other users' data...
📄 Ivanti Connect Secure 22.7R2.5 Remote Code Execution
This Metasploit module exploits a stack-based buffer overflow vulnerability in Ivanti Connect Secure to achieve remote code execution CVE-2025-22457. Versions 22.7R2.5 and earlier are vulnerable. Note that Ivanti Pulse Connect Secure, Ivanti Policy Secure and ZTA gateways are also vulnerable but...
Password Spray Attacks Taking Advantage of Lax MFA
In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...
Password Spray Attacks Taking Advantage of Lax MFA
In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...
Ivanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow
This module exploits a Stack-based Buffer Overflow vulnerability in Ivanti Connect Secure to achieve remote code execution CVE-2025-22457. Versions 22.7R2.5 and earlier are vulnerable. Note that Ivanti Pulse Connect Secure, Ivanti Policy Secure and ZTA gateways are also vulnerable but this module...
Microsoft Warns of Chinese Botnet Exploiting Router Flaws for Credential Theft
Microsoft has revealed that a Chinese threat actor it tracks as Storm-0940 is leveraging a botnet called Quad7 to orchestrate highly evasive password spray attacks. The tech giant has given the botnet the name CovertNetwork-1658, stating the password spray operations are used to steal credentials...
MAL-2024-2435 Malicious code in graffiti-alley-spray-cans (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in graffiti-alley-spray-cans (npm)
--- -= Per source details. Do not edit below this line.=-...
How are attackers trying to bypass MFA?
In the latest Cisco Talos Incident Response Quarterly Trends report, instances related to multi-factor authentication MFA were involved in nearly half of all security incidents that our team responded to in the first quarter of 2024. In 25% of engagements, the underlying cause was users accepting...