Vice Society Ransomware Attackers Adopt Robust Encryption Methods

The Vice Society ransomware actors have switched to yet another custom ransomware payload in their recent attacks aimed at a variety of sectors. "This ransomware variant, dubbed 'PolyVice,' implements a robust encryption scheme, using NTRUEncrypt and ChaCha20-Poly1305 algorithms," SentinelOne...

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti By Jambul Tologonov· November 22, 2022 Introduction On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s...

PT-2023-16367 · Unknown +1 · Phpgurukul Bank Locker Management System +1

Name of the Vulnerable Software and Affected Versions: PHPGurukul Bank Locker Management System version 1.0 Description: A problematic vulnerability has been found in the PHPGurukul Bank Locker Management System. This issue affects the file add-locker-form.php of the component Assign Locker. The...

Vice Society Hackers Are Behind Several Ransomware Attacks Against Education Sector

A cybercrime group known as Vice Society has been linked to multiple ransomware strains in its malicious campaigns aimed at the education, government, and retail sectors. The Microsoft Security Threat Intelligence team, which is tracking the threat cluster under the moniker DEV-0832, said the gro...

Vault can never fully be emptied

Lines of code Vulnerability details Impact Vault cannot be fully emptied Proof of Concept Whenever rewards are earned they are automatically locked into the the Aura Locker. Since that reward will then earn more rewards while locked, there will be more rewards to be collected when that lock is...

Reward token (auraBal) can be locked in the strategy

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. getRewardaddress account function of Aura Locker is an external function therefore can be called by anyone by passing in the address of strategy and transferring the rewards to the strategy. harvest...

WordPress OnePress Social Locker plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The CVE-2022-1608 entry concerns the WordPress plugin OnePress Social Locker (versions up to 5.6.2). The connected sources confirm a CSRF protection missing when updating settings, enabling a logged-in attacker to alter settings via a CSRF attack. No explicit fixed version is provided in the docu...

WordPress plugin OnePress Social Locker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

AuraBalRewardPool charges a penalty to all users in the pool if the AuraLocker has been shut down

Lines of code Vulnerability details Impact Users are charged the penalty due to admin actions, and they have no way to avoid it Proof of Concept When claiming their rewards, users are charged a penalty if they take the reward directly, rather than by passing it into the auraLocker. Those are the...

WordPress OnePress Social Locker plugin <= 5.6.2 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress OnePress Social Locker plugin versions = 5.6.2. Solution Deactivate and delete. This plugin has been closed as of May 6, 2022 and is not available for download. This closure is...

OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC...

WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin versions = 1.7.0. Solution Update the WordPress Go Viral – social share, social sharebar, social locker,...

WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin < 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin versions 1.2.2. Solution Update the WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin to the latest available version at least 1.2.2...

WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin < 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin versions 1.2.2. Solution Update the WordPress Pretty Opt In Lite – Content Locker for Lead Generation plugin to the latest available versi...

WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin versions = 1.7.0. Solution Update the WordPress Go Viral – social share, social...

Security update for firejail (important)

openSUSE Security Update: Security update for firejail Announcement ID: openSUSE-SU-2022:0037-1 Rating: important References: 1195880 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for firejail fixes the...