Simple IOC and Incident Response Scanner: Loki

LOKI is a free and simple IOC scanner, a complete rewrite of main analysis modules of our full featured APT Scanner THOR. IOC stands for „Indicators of Compromise“. These indicators can be derived from published incident reports, forensic analyses or malware sample collections in your Lab. LOKI...

CVE-2018-7728

An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFFHandler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update function in third-party/zuid/interfaces/MD5.cpp...

CVE-2018-7728

An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFFHandler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update function in third-party/zuid/interfaces/MD5.cpp...

CVE-2018-7728: Out-of-bounds Read

An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFFHandler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update function in third-party/zuid/interfaces/MD5.cpp...

CVE-2018-7728

An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFFHandler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update function in third-party/zuid/interfaces/MD5.cpp...

MainWP Child <= 3.4.4 - Authentication Bypass

Not authorized attacker could gain full control of target application if he knows the administrative user name. In case of openssl installed on the server then one request is enough and in case of md5 verification 100k requests will do the job...

Threat Analysis: ROKRAT Malware

ROKRAT also referred to as DOGcall is a family of malware that has been used by attackers originating from North Korea. The family continues to evolve and adopt techniques from other families also used by the same attack group. The ROKRAT core payload is typically deployed by a loader, which has...

Threat Outbreak Alert RuleID32138: Email Messages Distributing Malicious Software on February 27, 2018

Medium Alert ID: 56944 First Published: 2018 February 27 17:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32138 may contain the following files: Name |...

Threat Outbreak Alert RuleID31935: Email Messages Distributing Malicious Software on February 26, 2018

Medium Alert ID: 56934 First Published: 2018 February 26 18:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31935 may contain the following files: Name |...

Threat Outbreak Alert RuleID32119: Email Messages Distributing Malicious Software on February 26, 2018

Medium Alert ID: 56939 First Published: 2018 February 26 16:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32119 may contain the following files: Name |...

Threat Outbreak Alert RuleID32120: Email Messages Distributing Malicious Software on February 23, 2018

Medium Alert ID: 56926 First Published: 2018 February 23 17:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32120 may contain the following files: Name |...

Threat Outbreak Alert RuleID32123: Email Messages Distributing Malicious Software on February 23, 2018

Medium Alert ID: 56925 First Published: 2018 February 23 17:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32123 may contain the following files: Name |...

Threat Outbreak Alert RuleID32088: Email Messages Distributing Malicious Software on February 22, 2018

Medium Alert ID: 56911 First Published: 2018 February 22 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32088 may contain the following files: Name |...

Threat Outbreak Alert RuleID32118: Email Messages Distributing Malicious Software on February 22, 2018

Medium Alert ID: 56908 First Published: 2018 February 22 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32118 may contain the following files: Name |...

Threat Outbreak Alert RuleID31988: Email Messages Distributing Malicious Software on February 21, 2018

Medium Alert ID: 56877 First Published: 2018 February 21 20:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31988 may contain the following files: Name |...

Threat Outbreak Alert RuleID32099: Email Messages Distributing Malicious Software on February 21, 2018

Medium Alert ID: 56898 First Published: 2018 February 21 20:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32099 may contain the following files: Name |...

Threat Outbreak Alert RuleID32081: Email Messages Distributing Malicious Software on February 21, 2018

Medium Alert ID: 56888 First Published: 2018 February 21 20:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32081 may contain the following files: Name |...

Threat Outbreak Alert RuleID32077: Email Messages Distributing Malicious Software on February 21, 2018

Medium Alert ID: 56886 First Published: 2018 February 21 20:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32077 may contain the following files: Name |...

Threat Outbreak Alert RuleID32066: Email Messages Distributing Malicious Software on February 21, 2018

Medium Alert ID: 56880 First Published: 2018 February 21 17:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32066 may contain the following files: Name |...

Threat Outbreak Alert RuleID32048: Email Messages Distributing Malicious Software on February 20, 2018

Medium Alert ID: 56876 First Published: 2018 February 20 19:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32048 may contain the following files: Name |...