Path traversal

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

[Whitepaper] XDR vs. NDR/NTA – What do Organizations Truly Need to Stay Safe?

Security teams whose organizations are outside the Fortune 500 are faced with a dilemma. Most teams will have to choose between deploying either a network traffic analysis NTA or network detection and response NDR tool or an endpoint detection and response EDR tool to supplement their existing...

Exploit for CVE-2021-1675

PrintNightmare !imagehttps://user-images.githubusercontent...

CISA Publishes Malware Analysis Report and Updates Alert on DarkSide Ransomware

CISA has published a new Malware Analysis Report MAR on DarkSide Ransomware and updated Alert AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks, originally released May 11, 2021. This update adds indicators of compromise associated with a...

Open Redirect in unshiftio/url-parse

✍️ Description url-parse mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while url-parse sees it as a relative path. Similar attacks:...

TrickBot Botnet Found Deploying A New Ransomware Called Diavol

Threat actors behind the infamous TrickBot malware have been linked to a new ransomware strain named "Diavol," according to the latest research. Diavol and Conti ransomware payloads were deployed on different systems in a case of an unsuccessful attack targeting one of its customers earlier this...

Weak Password Vulnerability in DCFW-1800 Series Next-Generation Firewall of Digital China Cloud Computing

DCFW-1800 series next-generation firewalls identify thousands of network applications and provide detailed application risk analysis and flexible policy control. Weak password vulnerability exists in DCFW-1800 series next-generation firewalls, where attackers utilize weak passwords to log into th...

CoolCollege has an information breach

CoolCollege is a course service platform tailored for various companies. The software enhances learning efficiency and more through 36 scenarios such as course creation, assignment tracking, data analysis, and job certification. An information disclosure vulnerability exists in CoolCollege, which...

Unspecified Vulnerability in BinDiff

BinDiff is a tool for binary file analysis and comparison. A security vulnerability exists in BinDiff that can be exploited by an attacker to create a specific IdaPro .i64 file will cause the BinDiff plugin to load an invalid memory offset. The vulnerability can be exploited by an attacker to tak...

Plixer Scrutinizer SQL Injection Vulnerability

Plixer Scrutinizer is a network traffic analysis system that collects, analyzes, visualizes, and reports data from every network conversation and digital transaction to provide security and network intelligence. A SQL injection vulnerability exists in Plixer Scrutinizer version 19.0.2. An attacke...

Forblaze - A Python Mac Steganography Payload Generator

Forblaze is a project designed to provide steganography capabilities to Mac OS payloads. Using python3, it will build an Obj-C file for you which will be compiled to pull desired encrypted URLs out of the stego file, fetch payloads over https, and execute them directly into memory. It utilizes...

Wrong trading pricing calculations

Handle 0xsanson Vulnerability details Impact In the Pricing contract, an agent can manipulate the trading prices by spamming an high amount of trades. Indeed an agent can create an high amount of orders at an arbitrary price and with a near-zero amount so the agent doesn't even need large funds;...

CISA’s CSET Tool Sets Sights on Ransomware Threat

CISA has released a new module in its Cyber Security Evaluation Tool CSET: the Ransomware Readiness Assessment RRA. CSET is a desktop software tool that guides network defenders through a step-by-step process to evaluate their cybersecurity practices on their networks. CSET—applicable to both...

Use of deprecated Chainlink API

Handle 0xRajeev Vulnerability details Impact The contracts use Chainlink’s deprecated API latestAnswer. Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs. Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to...

Logic error in fee subtraction

Handle 0xsanson Vulnerability details Impact In LibBalances.applyTrade we need to collect a fee from the trade. The current code however subtracts a fee from the short position and adds it to the long. The correct implementation is to subtract a fee to both see TracerPerpetualSwaps.solL272. This...

Software composition analysis 101

Open source is everywhere. Learn how software composition analysis can automate open source management to secure your applications...

What is Penetration Testing❓ Definition, Stages, Techniques, Pros and Cons

The general concept is that penetration testing, frequently known as upright hacking, separates network security weaknesses by mimicking endeavors to penetrate protections. If it’s anything but, a real aggressor may exploit similar imperfections. Pen testing may manage a creation system or one...

REvil Ransomware Code Ripped Off by Rivals

They say imitation is the sincerest form of flattery: The LV ransomware, a strain that cropped up just this spring, turns out to be based on what is most likely pirated REvil ransomware code, according to researchers. A malware analysis of LV from Secureworks Counter Threat Unit CTU found that it...

Unused return value from Transfer()/ TransferFrom()

Handle JMukesh Vulnerability details Impact return value from transfer/ transferFrom confirm the success of that function call, these return should be checked Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps utilise the return value to check the success of the function ---...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during the syntactic analysis of GLB and STL files. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created...