Genymotion Desktop 代码问题漏洞

Genymotion Desktop is an Android emulator from Genymotion. A security vulnerability exists in Genymotion Desktop version 3.2.1, which stems from a missing profapi.dll, and can be exploited by an attacker to use a malicious dll with the same name and gain administrator privileges, as well as execu...

New Linux Cryptomining Malware

Its pretty nasty: The malware was dubbed "Shikitega" for its extensive use of the popular Shikata Ga Nai polymorphic encoder, which allows the malware to "mutate" its code to avoid detection. Shikitega alters its code each time it runs through one of several decoding loops that AT&T said each...

PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines

PersistenceSniper is a Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. The script is also available on Powershell Gallery. --- The Why Why writing such a tool, you might ask. Well, for starters, I...

Malicious code in internallib_v216 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 144eaae99291d0024df31c1ab7bdeb913ed704c53fd44a57a52a40df3c21cffd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stealthy Linux Malware Shikitega Deploying Monero Cryptominer

By Deeba Ahmed The stealthy malware leverages security flaws to gain privilege escalation and establish persistence. This is a post from HackRead.com Read the original post: Stealthy Linux Malware Shikitega Deploying Monero Cryptominer...

Privilege Escalation

poetry is vulnerable to privilege escalation. The vulnerability exists because the getsystemenv function of env.py does not properly validate the absolute path in windows operating systems, allowing an attacker to inject and execute malicious code and steal the credentials or persist their access...

Microsoft Warns of Ransomware Attacks by Iranian Phosphorus Hacker Group

Microsoft's threat intelligence division on Wednesday assessed that a subgroup of the Iranian threat actor tracked as Phosphorus is conducting ransomware attacks as a "form of moonlighting" for personal gain. The tech giant, which is monitoring the activity cluster under the moniker DEV-0270 aka...

Malicious code in www-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0115c38278defb9aa6cc167113c9895685e34e978da37c1337e2bb278abf8050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in workbox-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8933e331d7e07ec6d6389f4a473479e2d306032d9d3b394d9243d7268c811270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Metasploit Weekly Wrap-Up

ICPR Certificate Management This week Metasploit has a new ICPR Certificate Management module from Oliver Lyak and our very own Spencer McIntyre, which can be utilized for issuing certificates via Active Directory Certificate Services. It has the capability to issue certificates which is useful i...

MuddyWater targets Israeli organizations by exploiting unpatched log4j vulnerabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MuddyWater, an Iranian threat actor, exploits Log4j two vulnerabilities in SysAid applications to target Israeli organizations. As soon as the attacker gains access to the targeted organization, it...

Malicious code in funtion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 501077938fdff595541523797e68b1593506ab2dbebd6c2f4d34929227aef334 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discordjs-selfbot-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57a477d2c62670b4c2348d2776b1ecc1a8a07545f77fb1ce23e95003b49b9c86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in en-pagedjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66bcdf119d4bc88b1b012c59baf50c4065be047006c0b47a71243800dbbc5b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29850

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots...

CVE-2022-29850

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots...

CVE-2022-29850

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots...

Design/Logic Flaw

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots...

CVE-2022-29850

Summary: CVE-2022-29850 affects Lexmark printers/products through 2022-04-27. An attacker who has already compromised an affected Lexmark device can use improper input validation to maintain persistence across reboots. Affected component: Lexmark printer product line (unspecified models) with vul...

CVE-2022-29850

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots...