Attackers Use Event Logs to Hide Malware

Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines. The technique involves injecting shellcode directly into Windows event logs. This allows adversaries to use the Windows event logs as a cover for...

A new secret stash for “fileless” malware

In February 2022 we observed the technique of putting the shellcode into Windows event logs for the first time "in the wild" during the malicious campaign. It allows the "fileless" last stage Trojan to be hidden from plain sight in the file system. Such attention to the event logs in the campaign...

CVE-2022-28055

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

CVE-2022-28055

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

Command injection

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

CVE-2022-28055

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

CVE-2022-28055

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

CVE-2022-28055

FusionPBX v4.4 and earlier versions are affected by a command injection vulnerability in the Download Email Logs function. The CVE-2022-28055 entry is supported by multiple sources: Red Hat notes the issue in FusionPBX 4.4 and earlier; PT Security recommends upgrading to a version above 4.4; OSV,...

PT-2022-18782 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: Fusionpbx versions prior to 4.4 Description: The issue concerns a command injection vulnerability. This vulnerability can be exploited via the download email logs function. Recommendations: For Fusionpbx versions prior to 4.4, update to a...

CVE-2021-39020

IBM Guardium Data Encryption GDE 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 213855...

CVE-2022-0882

CVE-2022-0882 affects the Fuchsia kernel (Zircon kernel addresses) and allows information disclosure: an attacker can read the kernel log via exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. The issue is triggered by access to low-level kernel addressing, enablin...

Conti and Hive ransomware operations: What we learned from these groups' victim chats

As part of Cisco Talos’ continuous efforts to learn more about the current ransomware landscape, we recently examined a trove of chat logs between the Conti and Hive ransomware gangs and their victims. Ransomware-as-a-service groups have exploded in popularity over the past few years, with these...

Fuchsia 安全漏洞

Fuchsia is an open source general purpose operating system. A security vulnerability exists in versions of the Fuchsia kernel prior to 4.1.1, which can be exploited by an attacker to read kernel logs via an exposed Zircon kernel address without the required functionality of ZXRSRCKINDROOT...

GHSA-VMP5-C5HP-6C65 Woodpecker allows cross-site scripting (XSS) via build logs

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

Woodpecker allows cross-site scripting (XSS) via build logs

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

CVE-2022-29947

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

CVE-2022-29947

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

Cross site scripting

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

CVE-2022-29947

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...

CVE-2022-29947

CVE-2022-29947 affects Woodpecker (Woodpecker CI) prior to version 0.15.1. Root cause: missing escaping in web/src/components/repo/build/BuildLog.vue enables cross-site scripting via build logs. Impact: XSS in the client when rendering build logs. Mitigation: upgrade to Woodpecker v0.15.1 (as doc...