New Linux Variant of Bifrost RAT Utilizes Deceptive Domain for Evasion

Summary: A new Linux variant of the Bifrost RAT evades detection using a deceptive VMware domain, aiming to compromise systems. This persistent threat spreads through malicious emails and sites, harvesting sensitive data and now includes an ARM version, emphasizing the need for vigilant...

Savsoft Quiz 6.0 Enterprise Cross Site Scripting

Exploit Title: Savsoft Quiz v6.0 Enterprise - Persistent Cross-Site Scripting Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SAVSOFT QUIZ Vendor Homepage: https://savsoftquiz.com Software Link: https://savsoftquiz.com/web/index.php/online-demo/ Version: 6.0 CVE-ID: N/A Tested on: Kali Linux /...

PT-2024-20343

Name of the Vulnerable Software and Affected Versions 4ipnet EAP-767 version 3.42.00 Description The issue is related to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, and the content of the cookie remains unchanged...

Attacks, Vulnerabilities and Actors 5 to 11 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of five attacks were executed, six vulnerabilities were uncovered, and two active adversaries were...

PT-2024-2699 · Intel +1 · Intel Optane Pmem +1

Name of the Vulnerable Software and Affected Versions: IntelR OptaneTM PMem software versions prior to 01.00.00.3547 IntelR OptaneTM PMem software versions prior to 02.00.00.3915 IntelR OptaneTM PMem software versions prior to 03.00.00.0483 Description: The issue is related to improper access...

Priorities of the Joint Cyber Defense Collaborative for 2024

Today, CISA—on behalf of the collective group of industry and government partners that comprise the Joint Cyber Defense Collaborative JCDC—released JCDC’s 2024 Priorities. Similar to the 2023 JCDC Planning Agenda, JCDC’s 2024 Priorities will help focus the collective group on developing high-impa...

CVE-2023-45718

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

Session fixation

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718: Session Fixation

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2024-23452 Apache bRPC: HTTP request smuggling vulnerability

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.51.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The httpparser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a...

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code. The intrusion, which took place...

Malicious code in node-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20bbb441be4cc94e35a3bf9c020b6d6106d034a75a335ae40fe4528934720fe0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CherryTree Impostor Dubbed CherryLoader Makes Its Move

Summary: CherryLoader, a new Go-based downloader, has surfaced in cyber attacks, masquerading as the legitimate CherryTree note-taking app. This sophisticated threat infiltrates compromised hosts, delivering malicious payloads such as privilege escalation tools for exploitation and persistent...

ASB-A-300741186

In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not...

BIT-REVIEWBOARD-2021-31330

A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...

Malicious code in wlwz-2312-6802 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4a48a8fcdb28633f92dd057bc5d3d5d23bde5125b348b9e3b31c97d09bdee12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-5604 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6963caefff4a061651d4c8afe98aa2ecad2483accb3ff5b65aef1fdecfba5ec0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b18e5e39a5429b6581b662603e2cdc68aa4bbf45ccd6bd7b57ab11e59e70b9a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4701 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5647e3b4fee9f16ffbe29eb2b149fff29235e592669b9e4aec6ac1de97016a24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...