Posted by Ian Beer, Google Project Zero NOTE: This issue was CVE-2021-30983 was fixed in iOS 15.2 in December 2021.   Towards the ...

NodeJS runtime protection for supply chain attacks - GitHub - yaakov123/hagana: NodeJS runtime protection for supply chain attacks

High signal information security sources Goggle. Contribute to forcesunseen/netsec-goggle development by creating an account on GitHub.

Grav is an easy to use, yet powerful, open source flat-file CMS

Reveals invisible links within JavaScript files. Contribute to riza/linx development by creating an account on GitHub.

OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered trivially by an attacker. BoringSSL, LibreSSL and the OpenSSL 1.1.1 branch are n…

Contribute to hardenedvault/vaultboot development by creating an account on GitHub.

A new banking trojan targeting Europe has been discovered by Cleafy's Threat Intelligence Team. We dubbed it Revive and it is an evolution of simple spyware into a banking trojan, with the key capability of conducting Account Takeover attacks: here's the…

In this blog post we explore privilege escalation to SYSTEM with Intune managed devices, and how an Intune "Wipe" is not really a wipe at all.

CVE-2022-30522 is an Apache httpd vulnerability found by JFrog Security Research when analyzing the impact of a recent vulnerability patch. Read our analysis and guidance >

We discovered a vulnerability in Zimbra Enterprise Email that allows an unauthenticated, remote attacker fully take over Zimbra instances via a flaw in unrar.

An attacker compromising a Cloudflare account can abuse Workers to establish persistence and exfiltrate sensitive data.

During the exploitation phase of a pen test or ethical hacking engagement, you will ultimately need to try to cause code to run on target system computers. Whether accomplished by phishing emails, ...

CVE-2022-28219 is an unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory.

To escape the Safari sandbox for our Pwn2Own 2021 submission, we exploited a vulnerability in the Intel graphics acceleration kernel extensions (drivers) on ...

This will walk through the CloudGoat AWS detection_evasion scenario, detailing how to avoid AWS security detection and response services, such as in Lambda

Firefox, Chrome, Edge, Opera, and Internet Explorer browsers could be leaking users' credentials where autofill usernames and passwords can be accessed by JavaScript.

Stunned by losing their robotic devices, [REDACTED] learnt that they were hijacked by attackers even with communication being encrypted. Having researched its firmware and found numerous cryptographic failures, we've crafted a few demos on how cryptography…

elttam is an independent security company providing research-driven security assessment services. We combine pragmatism and deep technical insight to help our customers secure their most important assets.

Catch SOC Prime’s pick of top 3 most devastating data breaches that affected large businesses and left victims wondering: how they did it?