Exploit for Use After Free in Microsoft

CVE-2019-0708-POC Working proof of concept for...

Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques

This blog was authored by Danny Adamitis, David Maynor, and Kendall McKay Executive summary Cisco Talos assesses with moderate confidence that a campaign we recently discovered called "BlackWater" is associated with suspected persistent threat actor MuddyWater. Newly associated samples from April...

SQL Injection Vulnerability in co***_ru***_ed***.php of Acme CMS Backend

Acme CMS is a full-featured, PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction CMS building system. There is a SQL injection vulnerability in the backend corued.php of Acme CMS, which can be exploited by attackers to obtain sensitive...

Malicious Package

Overview All versions of carloprojectlesang contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. Recommendation Remove the package from your environmen...

Flerken - Obfuscated Command Detection Tool

Command line obfuscation has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". To bypass signature-based detection, dedicated obfuscation techniques are shown to be used by red-team penetrations and even APT activities. Meanwhile,...

GitHub hosted Magecart skimmer used against hundreds of e-commerce sites

Every day, new e-commerce websites fall into the hands of one of the many Magecart skimmers. Unbeknownst to shoppers, criminals are harvesting their personal information, including payment details in the online equivalent of ATM card skimming. Most often the skimming code—written in JavaScript an...

Design/Logic Flaw

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17287

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

SQL Injection Vulnerability in Xinhuo Collaboration Office System we***/mo***/wo***.php

Xinhuo Co-operation Office System is an office system based on php and mysql development. SQL injection vulnerability exists in we/mo/wo.php, which can be exploited by attackers to obtain sensitive database information...

HTML Containing Malicious VBScript Obfuscated

Certain VBScript obfuscation schemes can be used to circumvent security software. These methods could allow attackers to execute arbitrary code on the target machines...

TAU Threat Intelligence Notification – Fake Movie File Attack Targeting Cryptocurrency

A malicious Windows shortcut file is posing as a movie available on a torrent site - its payload is used to conduct web-injection, ultimately targeting victim’s web searches in browsers like Chrome, Firefox and Internet Explorer. The payload has the ability to search for and steal cryptocurrency...

Fnord - Pattern Extractor For Obfuscated Code

Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the file with...

SpeakUp Linux Backdoor Sets Up for Major Attack

LAS VEGAS — A backdoor trojan dubbed “SpeakUp” has been spotted exploiting the Linux servers that run more than 90 percent of the top 1 million domains in the U.S. It uses a complex bag of tricks to infect hosts and to propagate, which analysts say could indicate that it’s poised for a major...

Stealthy Malware Disguises Itself as a WordPress License Key

UPDATE A spam-injecting malware is targeting WordPress site owners by disguising itself as a legitimate license key for a WordPress design theme. According to analysis from Sucuri, a customer opened a malware removal ticket reporting “some weird spam URLs injected onto their WordPress website.”...

Magecart Returns with Advertising Library Tactic

The Magecart card-skimming crime conglomerate has changed up its tactics in recent campaigns, injecting malicious code into third-party Java libraries used by e-commerce websites to serve advertisements. Typically, Magecart subsidiaries tend to compromise a few targeted websites in order to...

Google Chrome URL Formatter Omnibox Forgery Vulnerability

Google Chrome is a web browser developed by Google, Inc. URL Formatter is one of the URL formatting components. A security vulnerability exists in URL Formatter in versions of Google Chrome prior to 71.0.3578.80, which stems from the program's incorrect handling of obfuscated characters. A remote...

Google Chrome Domain Spoofing Vulnerability (CNVD-2019-01766)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A domain spoofing vulnerability exists in Google Chrome. The vulnerability stems from the mishandling of obfuscated characters by the multifunction box in Google...

Google Chrome Domain Spoofing Vulnerability (CNVD-2019-01765)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A domain spoofing vulnerability exists in Google Chrome. The vulnerability stems from the URL Formatter in Google Chrome mishandling obfuscated characters. A remote...

Google Chrome Domain Spoofing Vulnerability (CNVD-2019-01764)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A domain spoofing vulnerability exists in Google Chrome. The vulnerability stems from the URL Formatter in Google Chrome mishandling obfuscated characters. A remote...

Google Chrome Domain Spoofing Vulnerability (CNVD-2019-01760)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A domain spoofing vulnerability exists in Google Chrome. The vulnerability stems from the URL Formatter in Google Chrome mishandling obfuscated characters. A remote...