1024 matches found
Public preview: Improve Win32 app security via app isolation
The post Public preview: Improve Win32 app security via app isolation appeared first on Microsoft Security Blog...
CVE-2022-47529
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...
Code injection
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...
CVE-2022-47529
The CVE-2022-47529 issue affects RSA NetWitness Platform’s NetWitness Endpoint EDR Agent prior to version 12.2. It stems from insecure Win32 memory objects that let local or admin Windows users modify the endpoint agent service configuration, enabling actions such as disabling the service or exec...
RSA NetWitness Endpoint EDR Agent 12.x Incorrect Access Control / Code Execution
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/RSANETWITNESSEDRAGENTINCORRECTACCESSCONTROLCVE-2022-47529.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor RSA Security www.netwitness.com Product NetWitness Endpoint...
Microsoft Windows UTF-8 Buffer Overruns Exploit
When Microsoft released UTF-8 support for the -A interfaces of the Windows API, it appears to have introduced buffer overrun conditions. Hi @ll, almost 4 years ago, with Windows 10 1903, after more than a year beta-testing in insider previews, Microsoft finally released UTF-8 support for the -A...
Backdoor.Win32.InCommander.17.b MVID-2022-0665 Hardcoded Credentials
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/dd76d8a5874bf8bf05279e35c68449ca.txt Contact: [email protected] Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.InCommander.17.b Vulnerability:...
Backdoor.Win32.Autocrat.b MVID-2022-0660 Weak Hardcoded Credential
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/4262a8b52b902aa2e6bf02a156d1b8d4.txt Contact: [email protected] Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Autocrat.b Vulnerability: Weak...
CVE-2022-41113
CVE-2022-41113 is a Windows Win32 Kernel Subsystem elevation-of-privilege vulnerability. Connected docs corroborate exploitation in the Win32 Kernel area (item: Win32 Kernel Subsystem). Public exploits exist per Attackerkb listing. Microsoft advisories point to security updates addressing Windows...
PT-2022-5656 · Microsoft · Windows Win32 Kernel Subsystem +1
Name of the Vulnerable Software and Affected Versions: Windows Win32 Kernel Subsystem affected versions not specified Description: The issue is related to insufficient access control in the Windows Win32 Kernel Subsystem, allowing an attacker to elevate their privileges. This can impact the syste...
Microsoft Client Server Run-time Subsystem (CSRSS) Privilege Elevation Vulnerability
Microsoft Client Server Run-time Subsystem is a client/server run-time subsystem from Microsoft Corporation of the United States, manifested as the csrss.exe process. It is a component of the Windows NT operating system family, appearing in Windows NT 3.1 and later systems, providing the user mod...
Microsoft Client Server Run-time Subsystem (CSRSS) Privilege Elevation Vulnerability
Microsoft Client Server Run-time Subsystem is a client/server run-time subsystem from Microsoft Corporation of the United States, manifested as the csrss.exe process. It is a component of the Windows NT operating system family, appearing in Windows NT 3.1 and later systems, and provides the user...
Trojan-Dropper.Win32.Corty.10 MVID-2022-0639 Insecure Credential Storage
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Corty.10 Vulnerability: Insecure Credential Storage Description: The...
Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory
A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for testing or...
Win32.Ransom.BlueSky MVID-2022-0632 Code Execution
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/961fa85207cdc4ef86a076bbff07a409.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.Ransom.BlueSky Vulnerability: Arbitrary Code Execution Description: The BlueSky...
OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents
In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away from being...
MAL-2022-5551 Malicious code in ql-win32 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f817e5f74fe07b3d1827fc187f8fb73dd5679aed0de7d1129ac2bd4512019c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ql-win32 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f817e5f74fe07b3d1827fc187f8fb73dd5679aed0de7d1129ac2bd4512019c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability in the `ext/standard/link_win32.c` component of the PHP interpreter allows a perpetrator to compromise data confidentiality.
The vulnerability of the ext/standard/linkwin32.c component of the PHP interpreter involves exposing protected information. Exploiting this vulnerability could allow a malicious actor to compromise data confidentiality remotely...