PT-2022-29997

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.34 Description The issue is related to a task leak in the pm8001 send abort all function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

CVE-2021-21967

An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2021-45228

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

CVE-2021-45228

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

COINS Construction Cloud 跨站脚本漏洞

COINS Construction Cloud is an end-to-end suite of cloud and mobile software solutions from COINS, Inc. designed to help construction executives drive increased profitability across their business. A cross-site scripting vulnerability exists in COINS Construction Cloud version 11.12, which stems...

CVE-2021-45228: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

PT-2022-12313

Name of the Vulnerable Software and Affected Versions COINS Construction Cloud version 11.12 Description An issue was discovered due to insufficient neutralization of user input in the description of a task, allowing malicious JavaScript code to be stored and later executed when reflected back to...

PT-2022-9221

Name of the Vulnerable Software and Affected Versions SeaConnect 370W version 1.3.34 Description An out-of-bounds write issue exists in the OTA update task functionality. A specially-crafted MQTT payload can cause denial of service. This can be triggered by an attacker performing a...

CVE-2021-21967: Buffer Copy without Checking Size of Input

An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

Tarrask malware uses scheduled tasks for defense evasion

As Microsoft continues to track the high-priority state-sponsored threat actor HAFNIUM, new activity has been uncovered that leverages unpatched zero-day vulnerabilities as initial vectors. The Microsoft Detection and Response Team DART in collaboration with the Microsoft Threat Intelligence Cent...

PT-2022-36928

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, identified as a Stack-use-after-scope WRITE 1 issue. The crash involves the grk::WaveletReverse::decompress partial tile functio...

Researchers Uncover How Colibri Malware Stays Persistent on Hacked Systems

Cybersecurity researchers have detailed a "simple but efficient" persistence mechanism adopted by a relatively nascent malware loader called Colibri, which has been observed deploying a Windows information stealer known as Vidar as part of a new campaign. "The attack starts with a malicious Word...

ScheduleRunner - A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation

Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and lateral movement. A number of C tools were already developed to simulate the attack using scheduled task. I have been playing around with some...

Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique

This blog post was authored by Ankur Saini, with contributions from Hossein Jazi and Jérôme Segura 2022-04-07: Added MITRE ATT&CK mappings 2022-04-07: Changed the name of the final payload from Vidar to Mars Stealer Colibri Loader is a relatively new piece of malware that first appeared on...

GitLab Authentication Issue

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the possibility of adding metadata during the creation of a task by an unauthorized user. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...

Apache DolphinScheduler Denial of Service Vulnerability

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, is a denial-of-service vulnerability in versions prior to Apache DolphinScheduler 2.0.5, which stems from a user registration interface that does not properly handle incoming...

CVE-2021-40645

An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController...

CVE-2021-40645

An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController...

CVE-2021-41594

In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieve...

CVE-2021-41594

In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieve...