GhostTask

Attività Pianificata Ghost Ispirato dalla ricerca di WithSecure sulla Scheduled Task Tampering, hanno spiegato la fattibilità di creare un'attività pianificata esclusivamente attraverso la manipolazione delle chiavi di registro. Un approccio di questo tipo può bypassare la generazione di log di...

CVE-2023-23192

CVE-2023-23192 CVE-2023-23192- Userlock - Bypass dell'Autenticazione Multi-Fattore MFA Titolo dell'Exploit: Userlock - Bypass dell'Autenticazione Multi-Fattore MFA Data: 01/11/2023 Autore dell'Exploit: Pinar Sadioglu Homepage del fornitore: https://www.isdecisions.com/products/userlock/help/...

ScheduleRunner

ScheduleRunner - Uno strumento C con maggiore flessibilità per personalizzare le attività pianificate per persistenza e movimento laterale nelle operazioni di red team L'attività pianificata è una delle tecniche di attacco più popolari dell'ultimo decennio e viene ancora comunemente utilizzata da...

CVE-2025-60710

CVE-2025-60710 Dies ist ein PoC für eine lokale Privilegienausweitung-Schwachstelle im geplanten Task \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Wenn dieser geplante Task gestartet wird, versucht der Prozess taskhostw.exe, das Verzeichnis...

CVE-2025-60710

CVE-2025-60710 Dies ist ein PoC für eine lokale Privilegienausweitungsschwachstelle im geplanten Task \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Wenn dieser geplante Task gestartet wird, versucht der taskhostw.exe-Prozess, das Verzeichnis...

pyGPOAbuse

pyGPOAbuse Aggiunte di Filtri di D4RKMATT3R AVVISO: Questo è stato testato solo brevemente in un ambiente AD locale; non mi assumo alcuna responsabilità per comportamenti imprevisti o malfunzionamenti. Viene fornito così com'è, solo per test autorizzati, interamente a proprio rischio. Ora support...

PT-2026-71690

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-17598

CVE-2026-17598 affects Sonatype Nexus Repository 3. The issue is improper input validation in scheduled task configuration: internal configuration keys from user-supplied task properties are not properly filtered when creating/updating a scheduled task via the admin UI. A user with permission to ...

Malicious code in crypto-validate-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...

MAL-2026-10586 Malicious code in crypto-validate-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...

MAL-2026-10591 Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

CVE-2026-15499

AstrBotDevs AstrBot (versions up to 4.25.2) contains a vulnerability in the function FutureTaskTool.call (astrbot/core/tools/cron_tools.py). Manipulating payload["note"] leads to improper authorization, enabling remote exploitation. Public exploit availability is reported. No remediation details ...

MAL-2026-6357 Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in package-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69b86134d9cd019c2d8ad172eed54cd4a48839d69ed2c6af52b79ef5080da765 [email protected] ships an install-hook.js that runs automatically as the npm postinstall script package.json declares "postinstall": "node...

Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware

The North Korean state-sponsored hacking group known as ScarCruft aka APT37 has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver a new malware called NarwhalRAT. "The attack email contained a message impersonating an MS account security...

EUVD-2026-36679

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass...