Malicious Package

Overview schema-render is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of...

Malicious Package

Overview klook-ui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of Snyk'...

Malicious Package

Overview tetris-scripts is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of...

Malicious Package

Overview rce-techroom is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of...

Malicious Package

Overview selenium-applitools is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by o...

Malicious Package

Overview klook-node-framework-currency is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was...

Panchan?s Mining Rig: New Golang Peer-to-Peer Botnet Says ?Hi!?

Akamai researchers have discovered a new P2P botnet targeting APJ. Read about it here...

What Counts as “Good Faith Security Research?”

The U.S. Department of Justice DOJ recently revised its policy on charging violations of the Computer Fraud and Abuse Act CFAA, a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging securit...

New XLoader Botnet Version Using Probability Theory to Hide its C&C Servers

An enhanced version of the XLoader malware has been spotted adopting a probability-based approach to camouflage its command-and-control C&C infrastructure, according to the latest research. "Now it is significantly harder to separate the wheat from the chaff and discover the real C&C servers amon...

[Security Nation] Amit Serper on Finding Leaks in Autodiscover

!\Security Nation\ Amit Serper on Finding Leaks in Autodiscoverhttps://blog.rapid7.com/content/images/2022/02/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Amit Serper, Director of Security Research at Akamai, on his work uncovering a flaw in the Autodiscover...

WordPress 5.9 Cross Site Scripting

Document Title: =============== Wordpress = 5.9 Cross-Site Scripting Reflected Authenticated Credits & Authors: ================== Taurus Omar [email protected] Disclosure Type: ================ Independent Security Research Release Date: ============= 2022-31-01 Vulnerability Disclosure...

CVE-2022-21724 Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

CVE-2022-21724

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

Exploit for SQL Injection in Zabbix

This repository is an open-source collection of vulnerable web applications and tools for security research and education, maintained by phith0n. It is an offensive tool for web application security research. The repository contains various vulnerable web applications, including CouchDB, FFmpeg,...

vulhub

This is an open-source collection of vulnerable web applications and environments for security research and training. It is a repository of vulnerable systems, including web applications, databases, and other software, designed to help security professionals and researchers practice and improve...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

XSYS-Log4J2Shell-Ex CVE-2021-44228 log4j2shell PoC as part...

cWifi Hotspot Wireless CP - Code Execution Vulnerability

Document Title: =============== cWifi Hotspot Wireless CP - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2310 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228: Log4j / Log4Shell Security Research Summary...

Intel Is Maintaining Legacy Technology for Security Research

Interesting: Intel’s issue reflects a wider concern: Legacy technology can introduce cybersecurity weaknesses. Tech makers constantly improve their products to take advantage of speed and power increases, but customers don’t always upgrade at the same pace. This creates a long tail of old product...

vulhub

This repository is an open-source collection of vulnerable web applications and tools for security training and research. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of vulnerable applications, including web servers, databases, and other systems, to help...