PT-2023-31461 · Cesanta · Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MJS versions 2.20.0 through 2.22.0 Description: The issue is related to an out-of-bounds read in the getprop builtin foreign function when a Built-in API name occurs in a substring of an input string. This can lead to a buffer overflo...

CISA and Partners Release Advisory on Russian SVR-affiliated Cyber Actors Exploiting CVE-2023-42793

Today, CISA—along with the U.S. Federal Bureau of Investigation FBI, National Security Agency NSA, Polish Military Counterintelligence Service SKW, CERT Polska CERT.PL, and the UK’s National Cyber Security Centre NCSC—released a joint Cybersecurity Advisory CSA, Russian Foreign Intelligence Servi...

The vulnerability of the SEMCMS_Upfile.php script of the website management system used by SemCms’ foreign trade enterprises allows a hacker to execute arbitrary code.

The vulnerability of the SEMCMSUpfile.php script in the website management system used by SemCms foreign trade enterprises involves unlimited downloading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

SugarGh0st RAT A Customized Gh0st Variant in Cyber Espionage

Summary: A malicious campaign deploying the customized SugarGh0st RAT, likely orchestrated by a Chinese-speaking threat actor targeting the Uzbekistan Ministry of Foreign Affairs and South Korean users. SugarGh0st, a variant of Gh0st RAT, exhibits advanced features for remote control, keylogging,...

New SugarGh0st RAT targets Uzbekistan government and South Korea

Cisco Talos recently discovered a malicious campaign that likely started as early as August 2023, delivering a new remote access trojan RAT we dubbed "SugarGh0st." We found evidence suggesting the threat actor is targeting the Uzbekistan Ministry of Foreign Affairs and users in South Korea. We...

CVE-2023-44390 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

CVE-2023-44390 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

Political Disinformation and AI

Elections around the world are facing an evolving threat from foreign actors, one that involves artificial intelligence. Countries trying to influence each others elections entered a new era in 2016, when the Russians launched a series of social media disinformation campaigns targeting the US...

HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe,...

GHSA-43CP-6P3Q-2PC4 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe,...

PT-2023-29225 · Unknown · Sanitize-Html

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 8.0.723 HtmlSanitizer version 8.1.722-beta and earlier Description: The issue occurs in configurations where foreign content is allowed, specifically when svg or math are in the list of allowed elements. This...

Earth Lusca’s Sneaky Moves Unleashes New Linux Backdoor

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Earth Lusca, a highly sophisticated Chinese threat actor, is believed to have resumed its operations in the first half of 2023. This cyber espionage group utilizes the SprySOCKS backdoor, primarily...

How China Demands Tech Firms Reveal Hackable Flaws in Their Products

Some foreign companies may be complying—potentially offering China’s spies hints for hacking their customers...

SEMCMS File Upload Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A file upload vulnerability exists in SEMCMS version 3.9, which stems from the application's lack of effective validation of uploaded files and can be exploited by an attacker to run arbitrary code via...

Researchers Uncover Years-Long Cyber Espionage on Foreign Embassies in Belarus

A hitherto undocumented threat actor operating for nearly a decade and codenamed MoustachedBouncer has been attributed to cyber espionage attacks aimed at foreign embassies in Belarus. "Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle AitM attacks at the...

SEMCMS SQL Injection Vulnerability (CNVD-2023-62957)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 1.5 suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the parameter id of /AntSuxin.php, which can be exploited b...

Midnight Blizzard conducts targeted social engineering over Microsoft Teams

Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard previously tracked as NOBELIUM. This latest attack, combined with past activit...

SEMCMS SQL注入漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 1.5 suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the parameter id of /AntSuxin.php, which can be exploited b...

Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia

By Waqas Ilya Sachkov was accused of treason by Russian authorities for providing classified cybersecurity data to a foreign intelligence firm. This is a post from HackRead.com Read the original post: Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia...

The Japanese Automotive Industry Attack Landscape

Recently, we released a major report analyzing the threat landscape of Japan, the globe’s third largest economy. In that report we looked at the ways in which threat actors infiltrate Japanese companies spoiler alert: it is often through foreign subsidiaries and affiliates and some of the most...