Aftermath - A Free macOS IR Framework

Aftermath is a Swift-based, open-source incident response framework. Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM ideally, but it can also run independently from the infected user's...

CVE-2022-4326 Trellix xAgent permission bypass vulnerability

Improper preservation of permissions vulnerability in Trellix Endpoint Agent xAgent prior to V35.31.22 on Windows allows a local user with administrator privileges to bypass the product protection to uninstall the agent via incorrectly applied permissions in the removal protection functionality...

CVE-2022-4326

The CVE-2022-4326 issue affects Trellix Endpoint Agent (xAgent) on Windows prior to V35.31.22. A faulty removal-protection permissions scheme allows a local administrator to bypass protections and uninstall the agent. Affected component is the removal-protection mechanism within xAgent; root caus...

Trellix Agent 安全漏洞

Trellix Agent is a client component of FireEye USA Trellix, Inc. provides secure communication between McAfee ePolicy Orchestrator McAfee ePO and hosted products. A security vulnerability exists in versions of Trellix Agent prior to V35.31.22, which stems from the fact that it allows a local user...

Mattermost: Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication

The Mattermost Desktop App for Windows 64-bit had a vulnerability where uninstalling and then reinstalling the app would automatically log the user back in without requiring authentication, allowing unauthorized access to the user's account and data. The uninstall process did not remove session...

Time to uninstall! Abandoned Android apps pack a vulnerability punch

Synopsis has published an advisory warning of multiple vulnerabilities across three different Android remote mouse and keyboard apps with a combined install count of about two million. The apps are at risk from remote code execution RCE, and theres no sign of a fix coming anytime, ever. Bleeping...

CVE-2022-1038

CVE-2022-1038 describes a potential privilege-escalation vulnerability in HP Jumpstart. The connected HP advisory indicates HP Jumpstart has been discontinued and replaced by the myHP software; HP recommends uninstalling Jumpstart and using myHP, with a Jumpstart Removal tool provided. Exploitati...

PT-2022-13611 · Hewlett Packard · Myhp +1

Name of the Vulnerable Software and Affected Versions: HP Jumpstart affected versions not specified Description: A potential security issue has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP recommends that customers uninstall HP Jumpstart and use myHP...

ansible-freeipa bug fix and enhancement update

An update is available for ansible-freeipa. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ansible-freeipa package provides Ansible roles and playbooks to...

MAL-2022-459 Malicious code in @nexthink/arm-jwt-decoder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51df48a51ecff12b69c9a30fb95f37dcd19cbf557c11e050fb5cd202e6a1d8be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-464 Malicious code in @nexthink/engage-branding (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb79566cb954829c3d41fcdbddd4922dd59511f8bf5215ff4b113c19fd60d526 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5824 Malicious code in rn-amazon-payment-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55dc607d7f550e21e91f6f04e1b1aed4b17e87f68d49c8f20d4fd3f413cbcc5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34102

Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an executable to gain a SYSTEM level command prompt...

PT-2022-22006 · Crestron · Crestron Airmedia Windows Application

Name of the Vulnerable Software and Affected Versions: Crestron AirMedia Windows Application version 4.3.1.39 Description: An insufficient access control issue was found in the Crestron AirMedia Windows Application. This issue allows a user to pause the uninstallation of an executable, resulting ...

MAL-2022-2553 Malicious code in docusaurus-plugin-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 232063f9bf78828e30e0c8bb7374c02a90b0a6bf29118093c955b5412deadddf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

The vulnerability of the Uninstall Protection function of the Crowdstrike Falcon endpoint protection software allows a malicious actor to remove the CrowdStrike software.

The vulnerability of the Uninstall Protection function of the Crowdstrike Falcon endpoint protection software is related to the implementation of an incorrect management flow. Exploiting this vulnerability could allow a malicious individual to remove the CrowdStrike software without using a valid...

MAL-2022-6584 Malicious code in tioredks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82288406f42e0b41e971b9c88fd0ad2e804534b72a105b490c59b8848cae6035 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3524 Malicious code in gulpyostcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d79c97be24aaf3e5a3ff83cf1d2ac08827ce0972da931a4bfe671ceb044fc268 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3971 Malicious code in isprgomise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adf40c4bcc3b052d6d6b47469c272f9f32fa4309628473f06d22743ee4fb675 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...