Warning: Fake GitHub Repos Delivering Malware as PoCs

By Waqas According to researchers, these fake accounts on GitHub and Twitter are spreading malware that infects both Windows- and Linux-based systems. This is a post from HackRead.com Read the original post: Warning: Fake GitHub Repos Delivering Malware as PoCs...

Buhti Ransomware Gang Switches Tactics, Utilizes Leaked LockBit and Babuk Code

The threat actors behind the nascent Buhti ransomware have eschewed their custom payload in favor of leaked LockBit and Babuk ransomware families to strike Windows and Linux systems. "While the group doesn't develop its own ransomware, it does utilize what appears to be one custom-developed tool,...

The vulnerability of Network Load Balancing (NLB) for Windows operating systems allows a attacker to execute arbitrary code.

The vulnerability of Network Load Balancing NLB for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created malware package...

The vulnerability of Group Policy Services in Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of Group Policy Services in Windows operating systems is related to the bypassing of security functions. Exploiting this vulnerability can allow an attacker to increase their privileges...

Chinese RedGolf Group Targeting Windows and Linux Systems with KEYPLUG Backdoor

A Chinese state-sponsored threat activity group tracked as RedGolf has been attributed to the use of a custom Windows and Linux backdoor called KEYPLUG. "RedGolf is a particularly prolific Chinese state-sponsored threat actor group that has likely been active for many years against a wide range o...

The vulnerability of the PCL6 Class Printer driver for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PCL6 Class Printer driver for Windows operating systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

PT-2023-1723 · Microsoft · Postscript/Pcl6 Class Printer Driver +1

Name of the Vulnerable Software and Affected Versions: Microsoft PostScript and PCL6 Class Printer Driver affected versions not specified Description: The issue is related to insufficient input validation in the PCL6 Class Printer Driver for Windows operating systems. This allows a remote attacke...

The vulnerability of the Kerberos protocol implementation in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Kerberos protocol in Windows operating systems arises from the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability allows a attacker to execute arbitrary code with SYSTEM privileges...

ChromeLoader Malware Targeting Gamers via Fake Nintendo and Steam Game Hacks

A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk VHD files, marking a deviation from the ISO optical disc image format. "These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games...

SUSE CVE-2021-2312

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2023-0012 Local Privilege Escalation in SAP Host Agent (Windows)

In SAP Host Agent Windows - versions 7.21, 7.22, an attacker who gains local membership to SAPLocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAPLocaAdmin are denied the ability to logo...

PT-2023-1233 · Microsoft · Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Microsoft DWM Core Library affected versions not specified Description: The issue is related to insufficient access control in the Microsoft DWM Core Library of Windows operating systems. It allows an attacker to elevate their privileges,...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome Mac and Linux versions prior to 108.0.5359.124, and Windows versions prior to 108.0.5359.125, which stems from a post-release reuse vulnerability in Blink Media...

IBM DB2 跨站请求伪造漏洞

IBM DB2 is a relational database management system from International Business Machines IBM, Inc. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions.IBM DB2 is vulnerable to cross-site request forgery, which can be exploited by an attacker to perform malicious and...

The vulnerability of the Kerberos protocol for Microsoft Windows operating systems allows a perpetrator to induce a service failure.

The vulnerability of the Kerberos protocol for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world. IceXLoader is a commodity malware that's sold for $118 on underground forums for a lifetime license. It's chiefly employed to...

CVE-2022-3369 Improper handling of registry symbolic links in Bitdefender Engines

An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It...

PYSEC-2022-43177

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. T...

PT-2022-23210 · Automox · Automox Agent

Name of the Vulnerable Software and Affected Versions: Automox Agent versions prior to 40 Description: The issue is related to incorrect permissions set on key files by the Automox Agent on Windows systems. Recommendations: For versions prior to 40, update to version 40 or later to resolve the...

CVE-2022-39421

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...