Webshells Observed in Post-Compromised Exchange Servers  

CISA has added two new Malware Analysis Reports MARs to Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities. Each new MAR AR21-084A and AR21-084B identifies a webshell observed in post-compromised Microsoft Exchange Servers. After successful exploiting a Microsoft Exchange Server...

Connection Failure Reports on Director

Reasons for the Connection failure reports on the Director...

HackerOne: User's who are banned from program can still be invited to the new reports as collaborators

Summary: Hello team! We have found out that the banned user's who are banned from program can be invited to the new reports as collaborator users. This is pretty weird because the hacker should be banned and no new reports shouldn't be allowed. If program bans the hacker the program can't invite...

HackerOne: Lack warning label when receiving a letter

Summary: Hi team, When using the function ShareReportViaEmail the email is sent to the email address specified by the hacker.This email looks legitimate and comes from verification email addresses, leaving no doubt about it being replaced. This endpoint also applies to sandbox reports which makes...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

CVE-2020-28150 affects I-Net Software Clear Reports 20.10.136 Web application. The vulnerability arises because a user-controlled input is used to specify a link to an external site and is subsequently used in a Redirect, enabling possible open-redirect behavior. Root cause: untrusted input used ...

I-Net Software Clear Reports 输入验证错误漏洞

I-net Software I-net software Clear Reports is a Java-based cross-platform reporting application from the German company I-net software I-net Software. The program supports the output of reports in PDF, HTML, PS and RTF formats. A security vulnerability exists in I-Net Software Clear Reports...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details...

Halogen - Automatically Create YARA Rules From Malicious Documents

Halogen is a tool to automate the creation of yara rules against image files embedded within a malicious document. Halogen help python3 halogen.py -h usage: halogen.py -h -f FILE -d DIR -n NAME --png-idat --jpg-sos Halogen: Automatically create yara rules based on images embedded in office...

DEBIAN-CVE-2021-23968

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox 86,...

CVE-2021-23969

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

UBUNTU-CVE-2021-23969

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

Mozilla: Content Security Policy violation report could have contained the destination of a redirect

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

CVE-2021-27509

In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code...

CVE-2021-23340

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...

CVE-2021-23340

CVE-2021-23340 affects pimcore/pimcore pre-6.8.8 and is a Local File Inclusion in the downloadCsvAction of CustomReportController.php. An authenticated user can access /admin/reports/custom-report/download-csv?exportFile=[...] with an unsanitized exportFile parameter, enabling local file inclusio...

CVE-2021-27103

creationtimestamp| type| source ---|---|--- 2021-02-17 00:48:04+00:00| seen| https://t.me/cibsecurity/23688 2021-02-23 15:58:16+00:00| seen| MISP/7391b143-ed2a-4938-b1eb-1198b56048a3 2021-07-29 17:59:02+00:00| seen| https://t.me/RussianOSINT/875 2021-10-25 22:32:43+00:00| seen|...

North Korean Malicious Cyber Activity: AppleJeus

CISA, the Federal Bureau of Investigation, and the Department of the Treasury have released a Joint Cybersecurity Advisory and seven Malware Analysis Reports MARs on the North Korean government’s dissemination of malware that facilitates the theft of cryptocurrency—referred to by the U.S...