1073 matches found
git: arbitrary code execution via .gitmodules
An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine...
5 (Not So) Scary Infosec Questions to Answer this Halloween
It’s Halloween. Time for candy checking, cavities and the start of the retail season. And while attacks will rise around the holidays, don't let the FUD machine get you too scared about things the go bump in the infosec night. Here are five things that should actually concern you. They were easil...
git: arbitrary code execution via .gitmodules
An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine...
Git Submodule - Arbitrary Code Execution (PoC)
These releases fix a security flaw CVE-2018-17456, which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field an...
Tesla Model S Hack Could Let Thieves Clone Key Fobs to Steal Cars
Despite having proper security measures in place to protect the driving systems of its cars against cyber attacks, a team of security researchers discovered a way to remotely hack a Tesla Model S luxury sedans in less than two seconds. Yes, you heard that right. A team of researchers from the...
Tesla Model S Hack Could Let Thieves Clone Key Fobs to Steal Cars
Despite having proper security measures in place to protect the driving systems of its cars against cyber attacks, a team of security researchers discovered a way to remotely hack a Tesla Model S luxury sedans in less than two seconds. Yes, you heard that right. A team of researchers from the...
CVE-2018-16806
A Pektron Passive Keyless Entry and Start PKES system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two...
Design/Logic Flaw
A Pektron Passive Keyless Entry and Start PKES system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two...
CVE-2018-16806
The CVE-2018-16806 entry concerns a Pektron Passive Keyless Entry and Start (PKES) system used in the Tesla Model S (and possibly other vehicles) that relies on the DST40 cipher. The vulnerability is described as enabling an attacker to clone a key fob within a few seconds after a 5.4 TB precompu...
CVE-2018-16806
A Pektron Passive Keyless Entry and Start PKES system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two...
Florida Man Arrested in SIM Swap Conspiracy
Police in Florida have arrested a 25-year-old man accused of being part of a multi-state cyber fraud ring that hijacked mobile phone numbers in online attacks that siphoned hundreds of thousands of dollars worth of bitcoin and other cryptocurrencies from victims. On July 18, 2018, Pasco County...
EulerOS 2.0 SP2 : git (EulerOS-SA-2018-1215)
According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - arbitrary code execution when recursively cloning a malicious repository CVE-2018-11235 Note that Tenable Network Security has extracted the preceding...
Design/Logic Flaw
Protection Mechanism Failure in ECOS Secure Boot Stick aka SBS 5.6.5 allows a local attacker to duplicate an authentication factor via cloning...
CVE-2018-12329
Protection Mechanism Failure in ECOS Secure Boot Stick aka SBS 5.6.5 allows a local attacker to duplicate an authentication factor via cloning...
CVE-2018-12329
ECOS Secure Boot Stick (SBS) 5.6.5 is affected by a Protection Mechanism Failure that allows a local attacker to duplicate an authentication factor via cloning. The CVE entry (CVE-2018-12329) notes a vulnerability in SBS 5.6.5; connected sources corroborate an authentication bypass/security restr...
CVE-2018-12329
Protection Mechanism Failure in ECOS Secure Boot Stick aka SBS 5.6.5 allows a local attacker to duplicate an authentication factor via cloning...
Security update for git (important)
This update for fixes the following security issues: path sanity-checks on NTFS can read arbitrary memory CVE-2018-11233, boo1095218 arbitrary code execution when recursively cloning a malicious repository CVE-2018-11235, boo1095219...
openSUSE Security Update : git (openSUSE-2018-557)
This update for fixes the following security issues : - path sanity-checks on NTFS can read arbitrary memory CVE-2018-11233, boo1095218 - arbitrary code execution when recursively cloning a malicious repository CVE-2018-11235, boo1095219 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Command and Control via Legitimate Behavior over HTTP: TrevorC2
TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil. There are two components to TrevorC2 – the client and the server. The client can be...
