Sneaky New Orbit Malware Backdoors Linux Devices

A sneaky malware for Linux is backdooring devices to steal data and can affect all the processes running on a particular machine, researchers have found. The malware, dubbed Orbit, is unlike other Linux threats in that it steals information from different commands and utilities and then stores th...

Bitter APT Hackers Continue to Target Bangladesh Military Entities

Military entities located in Bangladesh continue to be at the receiving end of sustained cyberattacks by an advanced persistent threat tracked as Bitter. "Through malicious document files and intermediate malware stages the threat actors conduct espionage by deploying Remote Access Trojans,"...

H3C Magic R100 安全漏洞

H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100, which stems from the updserver service opening an official backdoor on port 9034, allowing an attacker to execute arbitrary commands...

CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...

CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...

CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...

Input validation

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...

CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...

CVE-2021-41506

The CVE-2021-41506 entries describe backdoors in macGuarder and dvrHelper binaries within Xiaongmai DVR/NVR/IP camera firmware (affected models: AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2/-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 variants). Root cause: static root acc...

The SessionManager IIS backdoor

Following on from our earlier Owowa discovery, we continued to hunt for more backdoors potentially set up as malicious modules within IIS, a popular web server edited by Microsoft. And we didnt come back empty-handed… In 2021, we noticed a trend among several threat actors for deploying a backdoo...

Backdoor.Win32.Cafeini.b MVID-2022-0617 Hardcoded Credential

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/a8fc1b3f7a605dc06a319bf0e14ca68b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Cafeini.b Vulnerability: Weak Hardcoded Credentials Description: The malwar...

PT-2022-11421 · Xiongmai · Xiaongmai Ahb7804R-Els +4

Name of the Vulnerable Software and Affected Versions: Xiaongmai AHB7008T-MH-V2 Xiaongmai AHB7804R-ELS Xiaongmai AHB7804R-MH-V2 Xiaongmai AHB7808R-MS-V2 Xiaongmai AHB7808R-MS Xiaongmai AHB7808T-MS-V2 Xiaongmai AHB7804R-LMS HI3518 50H10L S39 version V4.02.R11.7601.Nat.Onvif.20170420 HI3518 50H10L...

Xiongmai多款产品 授权问题漏洞

Xiongmai AHB7008T-MH-V2 and others are a DVR from Xiongmai Technology Xiongmai, China. Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02. R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422,...

VulnCheck KEV: CVE-2020-26879

Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validatetoken.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header...

UnRAR Path Traversal in Zimbra (CVE-2022-30333)

This module creates a RAR file that can be emailed to a Zimbra server to exploit CVE-2022-30333. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in unRAR that can extract an arbitrary file to ...

TAR Path Traversal in Zimbra (CVE-2022-41352)

This module creates a .tar file that can be emailed to a Zimbra server to exploit CVE-2022-41352. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in the cpio command- line utlity that can...

Remote Code Execution

togglee is vulnerable to remote code execution. The vulnerability allows an attacker to inject and execute harmful code and access sensitive user information via a code execution backdoor...

Remote Code Execution

mlscanner is vulnerable to remote code execution. The vulnerability exists in the request package because it contains a malicious backdoor which allows an attacker to inject and execute harmful code and access sensitive user information...

Arbitrary Code Execution

catlytranslate is vulnerable to arbitrary code execution. The vulnerability exists in some catly-translate packages in Pypi because they create a malicious backdoor which allows an attacker to inject and execute arbitrary code...

Remote Code Execution (RCE)

texercise is vulnerable to remote code execution. When the package is installed, it opens a malicious backdoor in the package allowing an attacker to inject and execute arbitrary codes and gain access to sensitive user information and digital currency keys as well as escalate privileges...