6782 matches found
GHSA-2J55-PCW5-X4H2 active-support impersonates 'activesupport' gem
The active-support ruby gem gem is malware and duplicates the official activesupport no hyphen gem, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain 29faea63.planfhntage.de, downloads a payload, and executes. This trojan horse gem could allow a remote...
Black Hat Video Exclusive: Mobile APTs Redefining Phishing Attacks
LAS VEGAS: Mike Murray, vice president of security intelligence at Lookout, talks with Threatpost’s Tom Spring to discuss the latest trends in mobile advanced persistence threats APTs. He said mobile is redefining traditional inbox phishing. On smartphones, phishing includes dangerous links insid...
Microsoft DirectX SDK - Xact.exe Remote Code Execution
Microsoft DirectX SDK - Xact.exe Remote Code Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DIRECTX-SDK-XACT.EXE-TROJAN-FILE-CODE-EXECUTION.txt + ISR: Apparition Security Greetz: indoushka | Eduardo...
Microsoft DirectX SDK - Xact.exe Remote Code Execution Exploit
Exploit for windows platform in category remote exploits + Credits: John Page aka hyp3rlinx Vendor ============= www.microsoft.com Product =========== Microsoft DirectX SDK June 2010 Xact3.exe https://www.microsoft.com/en-us/download/details.aspx?id=6812 XACT Cross-platform audio creation tool is...
Threat Roundup for August 3-10
Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by...
Qualys BrowserCheck CoinBlocker Protects Users From Active Cryptojacking Campaigns
Qualys Malware Research Labs recently released the Qualys BrowserCheck CoinBlocker Chrome Extension. We have seen enthusiastic adoption from users across the globe in the first week since its release, which has given us enough telemetry data to indicate success in protecting users from popular...
North Korean Malicious Cyber Activity
The Department of Homeland Security DHS and the Federal Bureau of Investigation FBI have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. NCCIC...
Ramnit Changes Shape with Widespread Black Botnet
The recently uncovered “Black” botnet campaign using the Ramnit malware racked up 100,000 infections in the two months through July– but the offensive could just be a precursor to a much larger attack coming down the pike, according to researchers, thanks to a second-stage malware called Ngioweb...
Ukcms File Upload Vulnerability
UKcms is a content management system CMS written in the PHP language. A file upload vulnerability exists in UKcms 1.1.7 and earlier versions. The vulnerability stems from the program not strictly filtering the type of file uploads. An attacker can exploit this vulnerability by changing the...
CVE-2018-14911
A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by...
File Upload Vulnerability in Laoban CMS v2.0
Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. File upload vulnerability exists in Laoban CMS v2.0. The vulnerability is due to the system does not strictly filter the file upload...
Parasite HTTP RAT loaded with advanced detection evasion capability
By Waqas Proofpoint researchers have discovered a new remote access Trojan RAT as well as an updated version of an already identified banking Trojan and claim that both the RATs are involved in recently detected phishing campaigns targeting the retail, healthcare and IT industries. Emails...
CVE-2017-12148
A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...
Highly Sophisticated Parasite RAT Emerges on the Dark Web
Researchers are tracking a remote access trojan RAT on underground markets that, so far, has only been attributed to one small malicious email campaign. However, the RAT, dubbed Parasite HTTP by the Proofpoint researchers that discovered it, has an impressive list of sophisticated features –...
Design/Logic Flaw
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
CVE-2018-0619
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
Design/Logic Flaw
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
Design/Logic Flaw
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
