Apache Traffic Control 输入验证错误漏洞

Apache Traffic Control is a distributed and scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops is vulnerable to an input validation error, which is caused when an authenticated Apache Traffic Control Traffic Ops user with portal-level privileges...

Cloudflare Isn't Liable for Sites That Hawk Counterfeits

A federal judge ruled that the content-delivery service doesn't "contribute" to copyright infringement...

PT-2021-5224

Name of the Vulnerable Software and Affected Versions: Citrix ADC versions prior to 13.0-83.27 Citrix ADC versions prior to 12.1-63.22 Citrix ADC version 11.1-65.23 Description: An uncontrolled resource consumption issue exists that could allow an attacker with access to NSIP or SNIP with...

Exploit for Path Traversal in Microsoft

This is a malicious docx generator for exploiting CVE-2021-40444, a remote code execution vulnerability in Microsoft Office Word. The tool is designed to create a malicious docx document that, when opened, will execute arbitrary code on the victim's system. The tool consists of several files: 1...

The vulnerabilities of the Citrix ADC application delivery controller (formerly Citrix NetScaler Application Delivery Controller), the Citrix Gateway virtual environment access control system (formerly Citrix NetScaler Gateway), and the Citrix SD-WAN WANOP network management software are related to authentication process flaws, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of the Citrix ADC application delivery controller previously called Citrix NetScaler Application Delivery Controller, the Citrix Gateway virtual environment access control system previously called Citrix NetScaler Gateway, and the Citrix SD-WAN WANOP network management softwar...

The vulnerabilities of the Citrix ADC application delivery controller (formerly Citrix NetScaler Application Delivery Controller), the Citrix Gateway virtual environment access control system (formerly Citrix NetScaler Gateway), and the Citrix SD-WAN WANOP network management software are related to insufficient validation of input data. This allows a malicious individual to gain unauthorized access to protected information.

The vulnerabilities of the Citrix ADC application delivery controller previously called Citrix NetScaler Application Delivery Controller, the Citrix Gateway access control system previously called Citrix NetScaler Gateway, and the Citrix SD-WAN WANOP network management software are related to...

Red-Teaming-Toolkit

This is a collection of open source and commercial tools that aid in red team operations. The repository includes tools for reconnaissance, weaponization, delivery, command and control, lateral movement, establishing a foothold, escalating privileges, data exfiltration, and miscellaneous...

Fake Installers Drop Malware and Open Doors for Opportunistic Attackers

We recently spotted fake installers of popular software being used to deliver bundles of malware onto victims’ devices. These installers are widely used lures that trick users into opening malicious documents or installing unwanted applications...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability (CNVD-2021-99674)

Jazz is IBM Rational's next-generation collaboration platform for software delivery technology.The Jazz platform has been carefully designed and developed specifically for global and geographically diverse teams, and will change the way people collaborate to build software - improving the...

IBM Jazz for Service Management XML External Entity Injection Vulnerability

Jazz is IBM Rational's next-generation collaboration platform for software delivery technology.The Jazz platform has been carefully designed and developed specifically for global and geographically diverse teams, and will change the way people collaborate to build software - improving the...

MailRipV2 - Improved SMTP Checker / SMTP Cracker With Proxy-Support, Inbox Test And Many More Features

Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support SOCKS4 / SOCKS5 with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working! Overview Legal Notices You are ONL...

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2021-23337)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the template. By...

Security Bulletin: IBM Cloud Private is vulnerable to Helm vulnerabilities ( CVE-2021-21303)

Summary IBM Cloud Private is vulnerable to Helm vulnerabilities Vulnerability Details CVEID: CVE-2021-21303 DESCRIPTION: Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a...

Security Bulletin: IBM Cloud Private is vulnerable to Elastic vulnerabilities (CVE-2020-7018,CVE-2020-7019 )

Summary IBM Cloud Private is vulnerable to Elastic vulnerabilities Vulnerability Details CVEID: CVE-2020-7018 DESCRIPTION: Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by a credential exposure flaw in the App Search interface. By...

Phishing Attack Prevention — How to Spot, What Should Do❓ | Wallarm

Phishing Attack Prevention — How to Spot, What Should Do❓ No business, small or large, is impervious to phishing attacks. Some of the largest-scale attacks have been on renowned multi-million dollar corporations. Fortunately, there is a light at the end of the tunnel. It is possible to defend...

Introduction to Runtime Application Self-Protection (RASP)

Discover how runtime application self-protection RASP is shifting the narrative of application security and how to easily integrate RASP into your software for improved speed and delivery...

The Underground Economy: Recon, Weaponization & Delivery for Account Takeovers

This is Part I of a two-part blog series taking readers inside the criminal enterprise that is account-takeover fraud. For part II, please click here. With account takeover ATO attacks on the rise, stopping threat actors in the early phases of the kill chain will help today’s defenders gain an...