XSS on external links

Description This vulnerability allow for an administrator to create an evil external link. Proof of Concept As an admin user - Go to http://172.16.128.131/front/link.form.php?id=1 - Create an external link and put has value for the link javascript:alert1 - Assign this link to budgets example As a...

Malicious Package

Overview h3rmesk1t-npm-evil is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

MAL-2022-77 Malicious code in @anemone95/evil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fcf20845de5c96ccccec1c5ad18b641cc47c75a522c65f0914902401973caa6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Evidence Links Raspberry Robin Malware to Dridex and Russian Evil Corp Hackers

Researchers have identified functional similarities between a malicious component used in the Raspberry Robin infection chain and a Dridex malware loader, further strengthening the operators' connections to the Russia-based Evil Corp group. The findings suggest that "Evil Corp is likely using...

Infra Used in Cisco Hack Also Targeted Workforce Management Solution

The attack infrastructure used to target Cisco in the May 2022 incident was also employed against an attempted compromise of an unnamed workforce management solutions holding company a month earlier in April 2022. Cybersecurity firm eSentire, which disclosed the findings, raised the possibility...

Microsoft Links Raspberry Robin USB Worm to Russian Evil Corp Hackers

Microsoft on Friday disclosed a potential connection between the Raspberry Robin USB-based worm and an infamous Russian cybercrime group tracked as Evil Corp. The tech giant said it observed the FakeUpdates aka SocGholish malware being delivered via existing Raspberry Robin infections on July 26,...

Malicious code in evil-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d5712e6aa578ce6e0155c58afd67199a6e5b205a0c4b3fcdf19ea860bfd4c09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2902 Malicious code in evil-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d5712e6aa578ce6e0155c58afd67199a6e5b205a0c4b3fcdf19ea860bfd4c09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in evil-test-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5048a00a2021f79ef262234d0fbbc95d2a2c3f1cebcf2799666295c6fefbaace Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in evil-package-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b320e3dcc1537c8e96fd1d3a2bab84466c9c36e80222b7b2b147299b62029788 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2900 Malicious code in evil-package-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b320e3dcc1537c8e96fd1d3a2bab84466c9c36e80222b7b2b147299b62029788 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in evil-package-no-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f89aa37906751451562dd49ae34fbf0d01b7e329fcf2f7223c677a5d08c2ec1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2899 Malicious code in evil-package-no-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f89aa37906751451562dd49ae34fbf0d01b7e329fcf2f7223c677a5d08c2ec1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in omar-evil-test-rpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e5e94c35a9358e80839da1d1e54bf442ee12222b449aba7928ce4e04e801056 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Evil Corp Cybercrime Group Shifts to LockBit Ransomware to Evade Sanctions

The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in what's seen as an attempt by the latter to get around sanctions imposed by the U.S. Treasury in December 2019...

Evil Corp Pivots LockBit to Dodge U.S. Sanctions

Evil Corp has shifted tactics once again, this time pivoting to LockBit ransomware after U.S. sanctions have made it difficult for the cybercriminal group to reap financial gain from its activity, researchers have found. Researchers from Mandiant Intelligence have been tracking a “financially...

ALPINE-CVE-2022-31001

Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by define MATCHs, m strncmps, m, n = sizeofm - 1 == 0, which will make n...

UBUNTU-CVE-2022-31001

Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by define MATCHs, m strncmps, m, n = sizeofm - 1 == 0, which will make n...

DEBIAN-CVE-2022-31002

Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with %. Version 1.13.8 contains a patch for this issue...

UBUNTU-CVE-2022-31002

Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with %. Version 1.13.8 contains a patch for this issue...