CVE-2024-43468_mTLS_go

CVE-2024-43468 SCCM SQL 注入利用（基于 macOS 钥匙串的 mTLS 客户端证书版本） 使用 macOS 钥匙串进行 mTLS 认证（无需从钥匙串导出密钥）的 CVE-2024-43468 利用的 Go 实现。 此外： 增加了代理支持，避免使用有问题的 proxychains。 增加了 getcertname.py 用于获取证书通用名称（是的，你也可以手动从钥匙串访问 GUI 中获取）。 增加了大量调试信息，以便了解实际运行情况。 基于： 原始 Python 利用 mTLS Go 客户端示例 描述 利用 Microsoft Configuration...

Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

Malicious code in node-pino (npm)

node-pino is a one-edit typosquat of the popular pino logger that ships repackaged winston plus a malicious postinstall dropper. On npm install, the postinstall hook npm run license - node lib/winston/license spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob...

MAL-2026-6762 Malicious code in node-pino (npm)

node-pino is a one-edit typosquat of the popular pino logger that ships repackaged winston plus a malicious postinstall dropper. On npm install, the postinstall hook npm run license - node lib/winston/license spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob...

EUVD-2026-38604

Module: plugins/modules/keyringinfo.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS native keyring GNOME Keyring, macOS Keychain, Windows Credential Manager and places it directly into result"passphrase" with no output suppression...

Exploit for SQL Injection in Microsoft

CVE-2024-43468 SCCM SQL Injection Exploit mTLS client certs f...

Find the macOS keychain vulnerability of the 18-year-old boy decided to Apple announced all the details-vulnerability warning-the black bar safety net

In no, get Apple any remuneration case, Linus Henze decided to Apple filed for in the macOS keychain（Keychain）security software found a serious BUG. Before he choose to hide the BUG detail, to protest against Apple why not for the macOS platform starts Bug Bounty reward activities, but now he...

On the macOS Keychain Attack, Signal’s New Contact Service, the Deloitte Hack, and More

Mike Mimoso and Chris Brook recap the news of the week, including the macOS Keychain attack, Signal’s new private contact discovery service, the Deloitte hack, and a handful of mobile stock trading app vulnerabilities. Download: ThreatpostNewsWrapSeptember292017.mp3 Music by Chris Gonsalves Show...