DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Furto di Carte di Credito – Estrazione di Dati delle Carte L'analisi della memoria tramite Process Hacker rivela che DarkTortilla RAT prende di mira le informazioni delle carte di credito, inclusi numeri di carta, date di scadenza e tipi di carta. Stringhe Chiave Osservate: cardnumberencrypted...

Cross-Site Request Forgery (CSRF)

Apache JSPWiki is vulnerable to JSON Hijacking. The vulnerability is due to insecure handling of JSON responses, where the data can be accessed cross‑origin via a tag and attackers can exploit it to perform CSRF attacks and steal information...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...

Astra Linux – Vulnerability in git-lfs

Git LFS is an extension of Git for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host’s URL to the git-credential1 command without checking for embedded line-ending control characters. It then sends any credentials it receives back...

Astra Linux – Vulnerability in Thunderbird

Thunderbird ignored the configuration that required STARTTLS security for SMTP connections. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

Astra Linux – Vulnerability in Firefox

The “Copy Image Link” context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows—in conjunction with a Content Security Policy that stopped a redirection chain in the middle—the final image URL could contain an authentication toke...

shai-hulud-scan

shai-hulud-scan Una skill per Claude Code che analizza le macchine alla ricerca di indicatori di compromissione IOC del worm supply chain Mini Shai-Hulud CVE-2026-45321, CVSS 9.6. Cos'è Mini Shai-Hulud? Un worm self-propagating della supply chain che ha compromesso oltre 170 pacchetti npm/PyPI l'...

scan-shai-hulud

scan-shai-hulud Uno scanner Bash veloce e senza dipendenze per rilevare se la tua macchina è affetta dall'attacco alla supply chain CVE-2026-45321 "Mini Shai-Hulud". L'11 maggio 2026, oltre 170 pacchetti npm e 2 pacchetti PyPI attraverso TanStack, Mistral AI, UiPath, OpenSearch e Guardrails AI so...

MAL-2026-17582 Malicious code in bitciin (RubyGems)

RubyGems runs this gem's native extension script ext/bitciin/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes an...

MAL-2026-17615 Malicious code in wallet-crypto-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in wallet-crypto-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

pmp-exploit

pmp-exploit Dieser Exploit nutzt die Privilege-Escalation-Schwachstelle in Password Manager Pro aus, um einen regulären Benutzer zum SuperAdmin zu erheben und anschließend die in der Anwendung gespeicherten Passwörter und Dateien herunterzuladen. Betroffene Systeme Produkt : ManageEngine Password...

poisontap

PoisonTap - sottrae cookie, espone il router interno e installa backdoor web su computer bloccati Creato da @SamyKamkar || https://samy.pl Quando PoisonTap Raspberry Pi Zero e Node.js viene collegato a un computer bloccato/protetto da password , esso: emula un dispositivo Ethernet tramite USB o...

CVE-2022-45059-demo

CVE-2022-45059-Demo Die Varnish-Cache-Versionen 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 und 7.2.0 weisen eine Request-Smuggling-Schwachstelle auf, bei der ein Angreifer erreichen kann, dass der Content-Length-Header als Hop-by-Hop-Header behandelt wird. Dies ist eine Demo bestehend aus einer...

Malicious code in css-hgwctv-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95 On require, thunderboltRegistry.js runs an immediately-invoked function that uses childprocess.execSync to collect host identity and network...

CVE-2024-40507

CVE-2024-40507 Vulnerabilità di Cross Site Scripting in openPetra v.2023.02 tramite la funzione serverMPersonnel.asmx. Descrizione : Un utente non autenticato può rubare i cookie a un utente autenticato, sfruttando una XSS in openPetra v.2023.02 tramite la funzione serverMPersonnel.asmx. Versione...

CVE-2020-12629

Titolo: osTicket 1.14.1 - Cross-Site Scripting persistente autenticato Autore: Mehmet Kelepce / Gais Cyber Security Data : 2020-03-24 Link sorgente: https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884 CVE: https://vulners.com/cve/CVE-2020-12629 Exploit-Db :...

cve-2025-7771

CVE-2025-7771 — LPE di ThrottleStop.sys Proof-of-concept per CVE-2025-7771. ThrottleStop.sys espone due gestori IOCTL che consentono lettura/scrittura arbitraria della memoria fisica senza alcun controllo degli accessi — qualsiasi processo amministrativo può leggere o scrivere ovunque nella RAM...

EUVD-2026-92135

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

ThingsBoard-IoT-Platform-CVE-2024-55466

ThingsBoard Privilege Escalation Using Stored XSS Mentre armeggiavo con la tecnologia IoT, ho trovato una vulnerabilità nell'applicazione Thingsboard che consentiva strade per l'escalation dei privilegi. Thingsboard è un'applicazione open-source che consente la gestione dei dispositivi, la raccol...