FreeSWITCH 访问控制错误漏洞

FreeSWITCH is a free, open-source communications software program developed by Anthony Minessale, an individual developer in the United States. The software can be used to create audio, video, and SMS products and applications. An access control error vulnerability exists in FreeSWITCH versions...

Improper Privilege Management in shadow-maint/shadow

Description The su utility, if compiled with PAM support, uses waitpid internally to monitor its child process. It depends on the creation of zombie processes for proper monitoring, but the creation can be suppressed by ignoring the SIGCHLD signal see waitpid manual page. If su is spawned from a...

'Lone Wolf' Hacker Group Targeting Afghanistan and India with Commodity RATs

A new malware campaign targeting Afghanistan and India is exploiting a now-patched, 20-year-old flaw affecting Microsoft Office to deploy an array of commodity remote access trojans RATs that allow the adversary to gain complete control over the compromised endpoints. Cisco Talos attributed the...

CVE-2021-42009

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...

Apache Traffic Control 输入验证错误漏洞

Apache Traffic Control is a distributed and scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops is vulnerable to an input validation error, which is caused when an authenticated Apache Traffic Control Traffic Ops user with portal-level privileges...

Cloudflare Isn't Liable for Sites That Hawk Counterfeits

A federal judge ruled that the content-delivery service doesn't "contribute" to copyright infringement...

PT-2021-5224

Name of the Vulnerable Software and Affected Versions: Citrix ADC versions prior to 13.0-83.27 Citrix ADC versions prior to 12.1-63.22 Citrix ADC version 11.1-65.23 Description: An uncontrolled resource consumption issue exists that could allow an attacker with access to NSIP or SNIP with...

Exploit for Path Traversal in Microsoft

This is a malicious docx generator for exploiting CVE-2021-40444, a remote code execution vulnerability in Microsoft Office Word. The tool is designed to create a malicious docx document that, when opened, will execute arbitrary code on the victim's system. The tool consists of several files: 1...

The vulnerabilities of the Citrix ADC application delivery controller (formerly Citrix NetScaler Application Delivery Controller), the Citrix Gateway virtual environment access control system (formerly Citrix NetScaler Gateway), and the Citrix SD-WAN WANOP network management software are related to authentication process flaws, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of the Citrix ADC application delivery controller previously called Citrix NetScaler Application Delivery Controller, the Citrix Gateway virtual environment access control system previously called Citrix NetScaler Gateway, and the Citrix SD-WAN WANOP network management softwar...

The vulnerabilities of the Citrix ADC application delivery controller (formerly Citrix NetScaler Application Delivery Controller), the Citrix Gateway virtual environment access control system (formerly Citrix NetScaler Gateway), and the Citrix SD-WAN WANOP network management software are related to insufficient validation of input data. This allows a malicious individual to gain unauthorized access to protected information.

The vulnerabilities of the Citrix ADC application delivery controller previously called Citrix NetScaler Application Delivery Controller, the Citrix Gateway access control system previously called Citrix NetScaler Gateway, and the Citrix SD-WAN WANOP network management software are related to...

Red-Teaming-Toolkit

This is a collection of open source and commercial tools that aid in red team operations. The repository includes tools for reconnaissance, weaponization, delivery, command and control, lateral movement, establishing a foothold, escalating privileges, data exfiltration, and miscellaneous...

Fake Installers Drop Malware and Open Doors for Opportunistic Attackers

We recently spotted fake installers of popular software being used to deliver bundles of malware onto victims’ devices. These installers are widely used lures that trick users into opening malicious documents or installing unwanted applications...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability (CNVD-2021-99674)

Jazz is IBM Rational's next-generation collaboration platform for software delivery technology.The Jazz platform has been carefully designed and developed specifically for global and geographically diverse teams, and will change the way people collaborate to build software - improving the...

IBM Jazz for Service Management XML External Entity Injection Vulnerability

Jazz is IBM Rational's next-generation collaboration platform for software delivery technology.The Jazz platform has been carefully designed and developed specifically for global and geographically diverse teams, and will change the way people collaborate to build software - improving the...

MailRipV2 - Improved SMTP Checker / SMTP Cracker With Proxy-Support, Inbox Test And Many More Features

Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support SOCKS4 / SOCKS5 with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working! Overview Legal Notices You are ONL...

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2021-23337)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the template. By...

Security Bulletin: IBM Cloud Private is vulnerable to Helm vulnerabilities ( CVE-2021-21303)

Summary IBM Cloud Private is vulnerable to Helm vulnerabilities Vulnerability Details CVEID: CVE-2021-21303 DESCRIPTION: Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a...