OfflRouter virus causes Ukrainian users to upload confidential documents to VirusTotal

During a threat-hunting exercise, Cisco Talos discovered documents with potentially confidential information originating from Ukraine. The documents contained malicious VBA code, indicating they may be used as lures to infect organizations. The results of the investigation have shown that the...

Cross contract reentrancy attack through changing the xDomainMsgSender

Lines of code Vulnerability details Impact The use of the guaranteed safe CrossDomainMessenger for withdrawals can result in permanent blockages when the recipient address interacts with external addresses, which is an important feature for interoperability and is expected to be widely utilized...

Exploit for Improper Input Validation in Microsoft

CVE-2023-23397-POC-Using-...

[SECURITY] Fedora 35 Update: samba-4.15.12-0.fc35

Samba is the standard Windows interoperability suite of programs for Linux and Unix...

Malicious code in gather-electron-interop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 555d7a68ccecdb496e00c51f24d61369422e81fe64f0c26ead5b2512c5b85648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3277 Malicious code in gather-electron-interop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 555d7a68ccecdb496e00c51f24d61369422e81fe64f0c26ead5b2512c5b85648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview gather-electron-interop is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

MAL-2022-663 Malicious code in @tinyspeck/calls-desktop-interop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e86115cb7e307524c6253f3964ecd7ba26de3fddbc4cfe45bcb210dc0eddcd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinyspeck/calls-desktop-interop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e86115cb7e307524c6253f3964ecd7ba26de3fddbc4cfe45bcb210dc0eddcd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Threat Source newsletter for June 4, 2020

Newsletter compiled by Jon Munshaw. Our social media content and promotion are on pause this week as there are more important issues being discussed and other voices that need to be heard. However, we still wanted to provide users with the latest IOCs and threats we’re seeing. Upcoming public...

SUSE-SU-2020:0628-1 Security update for java-1_7_0-openjdk

This update for java-170-openjdk fixes the following issues: Update java-170-openjdk to version jdk7u251 January 2020 CPU, bsc1160968: - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2020-2590: Improve Kerberos interop capabilities - CVE-2020-2593: Normalize normalization for all -...

@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2020-5258 via dojo (>=1.13.0, <=1.13.6)

dojo NPM version =1.13.0, =1.0.0, =4.0.0-alpha.1, =0.1.10, =1.13.0, =1.13.0, =1.13.6 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

Threat Source newsletter (Feb. 20, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We’ve got more ways than ever for you to get Talos content. We continue to grow our YouTube page with the second entry in the “Stories...

Threat Source newsletter (Feb. 13, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. This month’s Microsoft Patch Tuesday was particularly hefty, with the company disclosing nearly 100 vulnerabilities — three of which Tal...

Threat Source newsletter (Feb. 6, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. There’s never been a better time to be into cyber security podcasts. Our Podcasts page on TalosIntelligence.com got a facelift this week...

SUSE-SU-2020:0261-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update java-180-openjdk to version jdk8u242 icedtea 3.15.0 January 2020 CPU, bsc1160968: - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2020-2590: Improve Kerberos interop capabilities - CVE-2020-2593: Normalize normalization for a...

@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (1.13.0)

dojo NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0-alpha.1, =0.1.10, =0.1.12 - dijit 1.13.0 - dojox 1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

SILENTTRINITY - A Post-Exploitation Agent Powered By Python, IronPython, C#/.NET

A post-exploitation agent powered by Python, IronPython, C/.NET. Requirements Server requires Python = 3.7 SILENTTRINITY C implant requires .NET = 4.5 How it works Notes .NET runtime support The implant needs .NET 4.5 or greater due to the IronPython DLLs being compiled against .NET 4.0, also the...

How to use. NET managed DCOM to achieve elevation of privilege-vulnerability warning-the black bar safety net

Affect the interoperability of technical vulnerabilities are a class of more interesting security vulnerabilities, this is because these vulnerabilities typically affect the use of the technology is any application, whether the application actually perform what operation. Similarly, in many cases...

Description of the cumulative update for Office Communications Server 2007 R2, Conferencing Attendant: April 2010

Describes the issues that are fixed in the cumulative update for Office Communications Server 2007 R2, Conferencing Attendant: April 2010.SummaryThis article describes the Office Communications Server 2007 R2, Conferencing Attendant issues that are fixed in the Office Communications Server 2007 R...