7228 matches found
84,000 WordPress Sites Affected by Three Plugins With The Same Vulnerability
On November 5, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “Login/Signup Popup”, a WordPress plugin that is installed on over 20,000 sites. A few days later we discovered the same vulnerability present in two...
WordPress Bugs Exploded in 2021, Most Exploitable
Last year brought forth much more than a Ben Affleck-Jennifer Lopez reunion – analysts found the number of exploitable WordPress plugin vulnerabilities exploded. Researchers from RiskBased Security reported they found the number of WordPress Plugin vulnerabilities rose by triple digits in 2021...
Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries
A study of 16 different Uniform Resource Locator URL parsing libraries has unearthed inconsistencies and confusions that could be exploited to bypass validations and open the door to a wide range of attack vectors. In a deep-dive analysis jointly conducted by cybersecurity firms Claroty and Snyk,...
A Log4j Retrospective Part 2: Data Exfiltration and Remote Code Execution Exploits
Akamai CTO Charlie Gero shows how the Log4j threat surface could extend to unpatchable embedded and IoT devices...
Photon OS 3.0: Binutils PHSA-2022-3.0-0348
An update of the binutils package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0348. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Debian DLA-2875-1 : clamav - LTS security update
The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2875 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network Security...
Photon OS 3.0: Vim PHSA-2022-3.0-0338
An update of the vim package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0338. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'...
Cross-site Scripting (XSS) - DOM in mrdoob/three.js
Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is window.location.hash and sink is iframe.src Proof of Concept 1 Visit...
pocsuite_poc_collect
It is an offensive tool for vulnerability exploitation. The repository appears to be a collection of proof-of-concept PoC exploits for various vulnerabilities, likely created using the Pocsuite framework. Not specified...
What the Rise in Cyber-Recon Means for Your Security Strategy
As we move into 2022, bad actors are ramping up their reconnaissance efforts to ensure more successful and more impactful cyberattacks. And that means more zero-day exploits are on the horizon. When seen through an attack chain such as the MITRE ATT&CK framework, campaigns are frequently discusse...
Hacking-Scripts
Hacking-Scripts - This is...
Mozilla Rust has an unspecified vulnerability (CNVD-2022-03130)
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. version 0.6.0 before Rust simpleasn1 crate 0.6.1 contains a security vulnerability that can be triggered if a remote attacker exploits the vulnerability to provide UTCTime data with a second character larger tha...
ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan
A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan. With ShonyDanza, you can: Obtain IPs based on search criteria Automatically exclude honeypots from the results based on your pre-configured thresholds Pre-configure all IP searches to filte...
Global Cyberattacks from Nation-State Actors Posing Greater Threats
The macro-trend I’m most alarmed by today is the fact that attackers don’t seem to care about getting caught anymore. We have seen an increase in temerity of attacks by nation-states, such as the Russian attack on SolarWinds, and seen their attack tactics shift from targeted, stealthy operations...
vulhub
This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and services. It contains a collection of exploits and tools for identifying and exploiting vulnerabilities in software and systems. The repository includes a variety ...
Answering Log4Shell-related questions
Important notice On December 18th, Log4j version 2.17.0 was released to address open vulnerabilities. It is highly recommended to update your systems as soon as possible. History of the Log4j library vulnerabilities CVE-2021-44228 initial vulnerability – partially fixed in 2.15.0 CVE-2021-45046...
Microsoft Patch Tuesday December 2021
Hello everyone! Its even strange to talk about other vulnerabilities, while everyone is so focused on vulnerabilities in log4j. But life doesnt stop. Other vulnerabilities appear every day. And of course, there are many critical ones among them that require immediate patching. This episode will b...
After Log4j, December’s Patch Tuesday has snuck up on us
For anyone about to sit back after checking their environment for the Log4j vulnerabilities and applying patches where needed, here are some more things that need patching. Microsoft In 2021’s final Patch Tuesday, Microsoft included a total of 67 fixes for security vulnerabilities. The total set ...
KLA12392 RCE vulnerability in Microsoft Azure
Remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-44228 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...