EUVD-2017-18919

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

EUVD-2025-33400

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't...

From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware

A China-aligned threat actor codenamed UTA0388 has been attributed to a series of spear-phishing campaigns targeting North America, Asia, and Europe that are designed to deliver a Go-based implant known as GOVERSHELL. "The initially observed campaigns were tailored to the targets, and the message...

CVE-2017-20203

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

CVE-2017-20203

NetSarang products including Xmanager Enterprise 5.0 (Build 1232), Xmanager 5.0 (Build 1045), Xshell 5.0 (Build 1322), Xftp 5.0 (Build 1218), and Xlpd 5.0 (Build 1220) are affected by a supply‑chain backdoor delivered via a malicious nssock2.dll. The DLL implements a multi‑stage, DNS‑based backdo...

CVE-2017-20203 NetSarang v5.0 Malicious Backdoor Supply Chain Compromise

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

CVE-2025-59957

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't...

CVE-2025-59957 Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't...

CVE-2025-59957 Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't...

Fake Teams Installers Dropping Oyster Backdoor (aka Broomstick)

Hackers are using fake Microsoft Teams installers found in search results and ads to deploy the Oyster backdoor. Learn how to protect your PC from this remote-access threat...

Exploit for Use After Free in Redis

CVE-2025-49844 - Redis Lua Interpreter Exploit !yuri08loveel...

PT-2025-41412

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

Bloodroot: When Watermarking Turns Poisonous for Stealthy Backdoor

Backdoor data poisoning is a crucial technique for ownership protection and defending against malicious attacks. Embedding hidden triggers in training data can manipulate model outputs, enabling provenance verification, and deterring unauthorized use. However, current audio backdoor methods are...

NetSarang多款产品 安全漏洞

NetSarang Xshell and others are products of NetSarang, Inc. of the U.S.A. NetSarang Xshell is NetSarang Xmanager is a powerful and convenient PC X server software package.NetSarang XLPD is a remote printing tool. A security vulnerability exists in several NetSarang products that stems from a...

PT-2025-41402

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.4R3 Juniper Networks Junos OS versions 22.2 before 22.2R3-S3 Description An Origin Validation Error exists in a file within Juniper Networks Junos OS on EX4600 Series and QFX5000 Series. An...

CVE-2025-34252

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

MAL-2025-48037 Malicious code in python-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Juniper Junos OS Vulnerability (JSA103146)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA103146 advisory. - An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated...

How Your AI Chatbot Can Become a Backdoor

In this post of THE AI BREACH, learn how your Chatbot can become a backdoor...

CVE-2025-34252

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 https://vulners.com/cve/CVE-2017-20203 to have the year of the CVE correspond to the year of public disclosure...