Carderbee Attacks: Hong Kong Organizations Targeted via Malicious Software Updates

A previously undocumented threat cluster has been linked to a software supply chain attack targeting organizations primarily located in Hong Kong and other regions in Asia. The Symantec Threat Hunter Team, part of Broadcom, is tracking the activity under its insect-themed moniker Carderbee. The...

WordPress Team Slider and Team Grid Showcase plus Team Carousel Plugin <= 2.6 is vulnerable to Broken Access Control

Software Team Slider and Team Grid Showcase plus Team Carousel Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b1cfd3da4f76...

CVE-2023-4330

Rejected reason: Broadcom were unable to duplicate the attack as described by Intel DCG Team...

Authentication flaw

Rejected reason: Broadcom were unable to duplicate the attack as described by Intel DCG Team...

CVE-2023-4330

PT-2023-28767 references Broadcom RAID Controller, describing a DoS via an authenticated REST API, implying an issue with the Broadcom RAID Controller web interface. The connected documents do not specify affected versions or a fix; no explicit exploit details are provided. The PT source notes th...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

CVE-2023-30533

creationtimestamp| type| source ---|---|--- 2023-08-11 03:59:21+00:00| published-proof-of-concept| https://t.me/crackcodes/4014 2023-08-11 04:00:05+00:00| published-proof-of-concept| Telegram/oCXtildE2yTi9IxdSuzh8AMqV0fg39dXN2lm3qeaYClxQ 2023-08-11 11:17:53+00:00| published-proof-of-concept|...

Security Updates for Microsoft Team Foundation Server and Azure DevOps Server (August 2023)

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by a server spoofing vulnerability. An attacker who successfully exploited the vulnerability would have to send the victim a malicious link that the victim would have to click for ...

QakBot Malware Operators Expand C2 Network with 15 New Servers

The operators associated with the QakBot aka QBot malware have set up 15 new command-and-control C2 servers as of late June 2023. The findings are a continuation of the malware's infrastructure analysis from Team Cymru, and arrive a little over two months after Lumen Black Lotus Labs revealed tha...

Security Bulletin: IBM Jazz Team Server is vulnerable to server-side request forgery. (CVE-2022-43879)

Summary IBM Jazz Team Server products is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Jazz Team Server – a part of IBM Application...

Microsoft’s AI Red Team Has Already Made the Case for Itself

Since 2018, a dedicated team within Microsoft has attacked machine learning systems to make them safer. But with the public release of new generative AI tools, the field is already evolving...

Shelly PRO 4PM v0.11.0 - Authentication Bypass

!/bin/bash Exploit Title: Shelly PRO 4PM v0.11.0 - Authentication Bypass Google Dork: NA Date: 2nd August 2023 Exploit Author: The Security Team exploitsecurity.io Exploit Blog: https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability Vendor...

A Penetration Testing Buyer's Guide for IT Security Teams

The frequency and complexity of cyber threats are constantly evolving. At the same time, organizations are now collecting sensitive data that, if compromised, could result in severe financial and reputational damage. According to Cybersecurity Ventures, the cost of cybercrime is predicted to hit ...

"Mysterious Team Bangladesh" Targeting India with DDoS Attacks and Data Breaches

A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service DDoS attacks and 78 website defacements since June 2022. "The group most frequently attacks logistics, government, and financial sector organizations in India and Israel,"...

Cloudflare Public Bug Bounty: Yet Another CASB Integration Takeover of Active Integrations

A vulnerability was found in a cloud access security broker's Microsoft integration where an attacker could bypass confused deputy protections. By manipulating the casing of a tenant UUID, a new integration could be created that surfaced sensitive customer information. This issue was addressed by...

A Bootiful Podcast: UL Systems founder and chairman Shigeru Urushibara interviews.. me?

Hi, Spring fans! I just crossed 13 years on the Spring team! I just got to spend a lovely day in the presence of one of my heroes and friends, UL Systems founder and chairman, Shigeru Urushibara-san @ulsystems, here in Tokyo, Japan, and in this episode, we sort of flip the script. We had a brief...

Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1117 Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

Patchwork Hackers Target Chinese Research Organizations Using EyeShell Backdoor

Threat actors associated with the hacking crew known as Patchwork have been spotted targeting universities and research organizations in China as part of a recently observed campaign. The activity, according to KnownSec 404 Team, entailed the use of a backdoor codenamed EyeShell. Patchwork, also...

IcedID Malware Adapts and Expands Threat with Updated BackConnect Module

The threat actors linked to the malware loader known as IcedID have made updates to the BackConnect BC module that's used for post-compromise activity on hacked systems, new findings from Team Cymru reveal. IcedID, also called BokBot, is a strain of malware similar to Emotet and QakBot that start...