7783 matches found
Malicious Package
Overview cd-system is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Friday Squid Blogging: Multiplexing SQUIDs for X-ray Telescopes
NASA is researching new techniques for multiplexing SQUIDs--thats superconducting quantum interference devices--for X-ray observatories. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
Exploit for Uncontrolled Resource Consumption in Apache Tomcat
CVE-2022-29885 The tool is only used for security research...
Malicious Package
Overview bb-netlify is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Exploit for Off-by-one Error in F5 Nginx
CVE-2021-23017-PoC pip install -r requirements.txt pytho...
Gallia - Extendable Pentesting Framework
Gallia is an extendable pentesting framework with the focus on the automotive domain. The scope of gallia is conducting penetration tests from a single ECU up to whole cars, with the main focus on the UDS interface. Taking advantage of this modular design, the logging and archiving functionality...
Leaky Access Tokens Exposed Amazon Photos of Users
The Amazon Photos app for Android insufficiently protected user access tokens, according to a blog post published on Wednesday. Theoretically, with exposed tokens, an attacker could’ve accessed users’ personal data from a number of different Amazon apps – not just Photos but also, for example,...
Malicious Package
Overview netlify-bb is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Akamai’s Observations of Confluence Zero Day (CVE-2022-26134)
The Atlassian Confluence vulnerability is here to stay. See Akamai's research into the stats two weeks after the advisory was released...
Akamai?s Observations of Confluence Zero Day (CVE-2022-26134)
The Atlassian Confluence vulnerability is here to stay. See Akamai's research into the stats two weeks after the advisory was released...
Malicious Package
Overview horizondev is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview rv-modal-store is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...
Malicious Package
Overview @pagetour/sdk is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Why It’s Time to Map the Digital Attack Surface
Trend Micro research reveals struggle to control cyber risks against mounting digital attack surfaces...
Why It’s Time to Map the Digital Attack Surface
Trend Micro research reveals struggle to control cyber risks against mounting digital attack surfaces...
Sealighter - Easy ETW Tracing for Security Research
I created this project to help non-developers dive into researching Event Tracing for Windows ETW and Windows PreProcessor Tracing WPP. Features Subscribe to multiple ETW and WPP Providers at once Automatically parse events into JSON without needing to know format Robust Event filtering including...
Exploit for Improper Restriction of XML External Entity Reference in Zohocorp Manageengine_Adaudit_Plus
CVE-2022-28219 POC for CVE-2022-28219 affecting ManageEngine A...
publications.goettingen-research-online.de Cross Site Scripting vulnerability OBB-2678079
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...