Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks

Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders...

Apple macOS 安全漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that stems from an application that may be able to modify protected portions of the file system. The following products and versions are affected: mac Studio...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS. An attacker exploiting this vulnerability could access sensitive user information. The following products and versions are affected: mac Studio version 2022, Ma...

Apple macOS 缓冲区错误漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from an application that could lead to a denial of service. The following products are affected: mac Studio 2022, Mac Pro 2019 and later models,...

Apple macOS 资源管理错误漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that stems from reuse after release, where applications may be able to execute arbitrary code with kernel privileges. The following products and versions are...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that stems from a sandboxed process that may be able to bypass sandbox restrictions. The following products and versions are affected: mac Studio version 2022, M...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that originates from an application that may be able to execute arbitrary code with kernel privileges. The following products and versions are affected: mac Stud...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that originates from an application that may be able to execute arbitrary code with kernel privileges. The following products and versions are affected: mac Stud...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that stems from a sandboxed process that may be able to bypass sandbox restrictions. The following products and versions are affected: mac Studio version 2022, M...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from the fact that sandboxed applications may be able to determine which application is currently using the camera. The following products and...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS has a security vulnerability that stems from an application that may disclose sensitive kernel state. The following products are affected: mac Studio 2022, Mac Pro 2019 and later models, MacBook A...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that originates from an application that may be able to execute arbitrary code with kernel privileges. The following products and versions are affected: mac Stud...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS that stems from type obfuscation, where applications may be able to execute arbitrary code with kernel privileges. The following products and versions are...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from the fact that users with physical access to the device may be able to use Siri to obtain some call log information. The following products and...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from applications that may be able to access sensitive user data. The following products and versions are affected: mac Studio version 2022, Mac Pr...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS. An attacker exploiting this vulnerability could access sensitive user information. The following products and versions are affected: mac Studio version 2022, Ma...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS. An attacker exploiting this vulnerability could access sensitive user information. The following products and versions are affected: mac Studio version 2022, Ma...

Apple macOS 安全漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that originates from the fact that a user with physical access to the device may be able to access contacts from the lock screen. The following products and...

.NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 6.0, .NET 5....