A journey into forgotten Null Session and MS-RPC interfaces, part 2

In the first part of our research, I demonstrated how we revived the concept of no authentication null session after many years. This involved enumerating domain information, such as users, without authentication. I walked you through the entire process, starting with the difference between no-au...

CVAD and DaaS: Troubleshooting missing logon duration in Citrix Director and Cloud Monitor

To troubleshoot missing logon duration information in monitor, please validate the prerequisites:https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/director/troubleshoot-deployments/user-issues/user-logon.htmlprerequisites Ensure Citrix Profile Management WMI Plug-in is installed:...

CVAD: Importance of LogonTimings WMI class for reporting Logon Duration in Citrix Director

Ques: Why is LogonTimings WMI class important for reporting Logon Duration in Citrix Director? Ans: LogonTimings WMI class is crucial for monitoring and reporting logon durations in Citrix environments. It provides detailed metrics that help administrators analyze and troubleshoot logon performan...

Linux Distros Unpatched Vulnerability : CVE-2023-52864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 drivers: misc: pass miscdevice pointer via file private data, the miscdevice stores a...

DEBIAN-CVE-2022-49523

In the Linux kernel, the following vulnerability has been resolved: ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash. Send spectral scan disable WMI...

CVE-2022-49123 ath11k: Fix frames flush failure caused by deadlock

In the Linux kernel, the following vulnerability has been resolved: ath11k: Fix frames flush failure caused by deadlock We are seeing below warnings: kernel: 25393.301506 ath11kpci 0000:01:00.0: failed to flush mgmt transmit queue 0 kernel: 25398.421509 ath11kpci 0000:01:00.0: failed to flush mgm...

CVAD: How to install Citrix Profile Management WMI Plug-in on the VDA

This article lists the steps to install the Citrix Profile Management WMI Plug-in on the VDA...

CVE-2024-45571

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface...

CVE-2022-33277

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command...

CVE-2022-40532

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target...

CVE-2024-45571

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface...

CVE-2024-45571 Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface...

CVE-2024-45571

CVE-2024-45571 affects Qualcomm WLAN components. The issue is memory corruption that occurs when stopping the WLAN interface after processing a WMI command, enabling local attacker with low privileges and no user interaction to impact confidentiality, integrity, and availability (all High). No pu...

PT-2025-30812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the platform/x86/dell-wmi-sysman component. A flaw exists in how WMI data blocks are retrieved in sysfs callbacks, potentially leading to issues...

CVE-2024-50236 wifi: ath10k: Fix memory leak in management tx

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks a...

CVE-2024-38410

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice...

CVE-2024-38410

CVE-2024-38410 involves memory corruption from calling IOCLT when a device is in an invalid state, with the WMI command buffer potentially freed twice. The issue is described across sources as a stack/heap memory corruption scenario affecting Qualcomm chipsets (notably WLAN-related) and is classi...

CVE-2024-38410 Stack-based Buffer Overflow in WLAN Windows Host

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice...

Analysis of the Crypt Ghouls group: continuing the investigation into a series of attacks on Russia

Last December, we discovered a new group targeting Russian businesses and government agencies with ransomware. Further investigation into this group's activity suggests a connection to other groups currently targeting Russia. We have seen overlaps not only in indicators of compromise and tools, b...

Microsoft Warns of New INC Ransomware Targeting U.S. Healthcare Sector

Microsoft has revealed that a financially motivated threat actor has been observed using a ransomware strain called INC for the first time to target the healthcare sector in the U.S. The tech giant's threat intelligence team is tracking the activity under the name Vanilla Tempest formerly DEV-083...