Researchers Uncover UEFI Secure Boot Bypass in 3 Microsoft Signed Boot Loaders

A security feature bypass vulnerability has been uncovered in three signed third-party Unified Extensible Firmware Interface UEFI boot loaders that allow bypass of the UEFI Secure Boot feature. "These vulnerabilities can be exploited by mounting the EFI System Partition and replacing the existing...

IIS extensions are on the rise as backdoors to servers

The Microsoft 365 Defender Research Team has warned that attackers are increasingly leveraging Internet Information Services IIS extensions as covert backdoors into servers. IIS extensions are able to stay hidden in target environments and as such provide a long-term persistence mechanism for...

Malicious IIS Extensions Gaining Popularity Among Cyber Criminals for Persistent Access

Threat actors are increasingly abusing Internet Information Services IIS extensions to backdoor servers as a means of establishing a "durable persistence mechanism." That's according to a new warning from the Microsoft 365 Defender Research Team, which said that "IIS backdoors are also harder to...

Malicious IIS extensions quietly open persistent backdoors into servers

Attackers are increasingly leveraging Internet Information Services IIS extensions as covert backdoors into servers, which hide deep in target environments and provide a durable persistence mechanism for attackers. While prior research has been published on specific incidents and variants, little...

Malicious code in list-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edf3b4ffccf50da436b9f927419f8d777691cbc30ad3918981b083e2e56b3bf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hksnzojebplygmqi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21accaf3bb53cec7046615b081b7c6becceb550b00328f3f7e2b737b4af51bb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in k-paste (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a6b12ef2387a7c507563af7c5478f0d551db852a6ecca091066addfac40414d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in relayfbnetworkloggercontroller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2587fa823e59d1ae56400abf30dc8821ef707d7a7ae3311b2434725bec036145 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-js-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16d1ebcc082e0916e1ebfbf2a580ae6ef9e6167138c0df20449a63917dcd6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calc_gcc1y6tzao (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb678abdeeba5838160d6c65054430f55c594eb35bb2db65478e5efe5bfaeb79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idcs-page-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1d8172ca3493517464b2899e39d788b122bc179a303d4f0113cba3a0e418faf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in synobot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7d32e0933815afa3994b61627ce34db9da815e634d137799479646c02119632 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dcrdex-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6be02fbf2b27fe3045237f52ae5f4a78595d536ddb916fe69859173d5cf0c070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @shared-ui/global-navigation-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3146f75b07c94a8fd45a30d06312fef2e4562d93ab98b0e3eb67da5051b5082e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in connect-rtc-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40845c567061d597a3e1c4893cdd7b653e68072e2d6cd0da33757014cec3fefa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smithy-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ca6db1d2e1b3b5d4cc263af07ad3bdac1620be7e66c259231937ba10ad755c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mckesson/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dff51f1f48b8a97a03eb5dd79bd1805a4ae0aecb1417e0dcce950ef3d3cf175 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @jerusalem/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91ea01a2f72a0291d2f0f283034dc11654a4505a3741a3e21328c920455a42f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Privilege escalation

Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the iragent.exe component, resulting in elevated rights and persistent access to t...

Rapid7 Insight Agent 代码问题漏洞

Rapid7 Insight Agent is a lightweight software from Rapid7, Inc. The software is capable of collecting data from IT assets.A security vulnerability exists in Rapid7 Insight Agent version 3.1.2.38 and prior versions, which stems from the fact that Rapid7 Insight Agent version 3.1.2.38 and prior...