Zero click vulnerability in Apple’s macOS Mail
https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c
https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c
Medium
Zero click vulnerability in Apple’s macOS Mail
Zero-Click Zip TL;DR
В продолжение темы бесплатных вебинаров VMware
• все прошедшие вебинары опубликованы в официальном YouTube VMware канале (на сегодня порядка ~10 докладов)
• сами вебинары продолжаются - тематику (тем достаточно, разных и интересных), расписание, регистрация - https://via.vmw.com/ERka
• организаторы обещают розыгрыши призов в конце каждого вебинара
P.S. Прошлый анонс на тему VMware вебинаров - https://news.1rj.ru/str/sysadm_in_channel/2915
В продолжение темы бесплатных вебинаров VMware
• все прошедшие вебинары опубликованы в официальном YouTube VMware канале (на сегодня порядка ~10 докладов)
• сами вебинары продолжаются - тематику (тем достаточно, разных и интересных), расписание, регистрация - https://via.vmw.com/ERka
• организаторы обещают розыгрыши призов в конце каждого вебинара
P.S. Прошлый анонс на тему VMware вебинаров - https://news.1rj.ru/str/sysadm_in_channel/2915
ACTIVE CYBERATTACKS ON MISSION-CRITICAL SAP APPLICATIONS
https://onapsis.com/active-cyberattacks-mission-critical-sap-applications
https://onapsis.com/active-cyberattacks-mission-critical-sap-applications
New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp
Обнаружена новая, вредоносная угроза в Google Play, которая распространяется через разговоры пользователей WhatsApp
Приложение представляет собой поддельный сервис, который утверждает, что позволяет пользователям просматривать контент Netflix со всего мира на своих мобильных устройствах. Называется приложение FlixOnline. Однако вместо того, чтобы позволить мобильному пользователю просматривать контент Netflix, приложение на самом деле предназначено для мониторинга уведомлений WhatsApp и автоматической отправки ответов на входящие сообщения пользователя с использованием контента, который получает с удаленного сервера C&C
https://research.checkpoint.com/2021/new-wormable-android-malware-spreads-by-creating-auto-replies-to-messages-in-whatsapp/
Обнаружена новая, вредоносная угроза в Google Play, которая распространяется через разговоры пользователей WhatsApp
Приложение представляет собой поддельный сервис, который утверждает, что позволяет пользователям просматривать контент Netflix со всего мира на своих мобильных устройствах. Называется приложение FlixOnline. Однако вместо того, чтобы позволить мобильному пользователю просматривать контент Netflix, приложение на самом деле предназначено для мониторинга уведомлений WhatsApp и автоматической отправки ответов на входящие сообщения пользователя с использованием контента, который получает с удаленного сервера C&C
https://research.checkpoint.com/2021/new-wormable-android-malware-spreads-by-creating-auto-replies-to-messages-in-whatsapp/
Check Point Research
New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp - Check Point Research
Research by: Aviran Hazum, Bodgan Melnykov & Israel Wenik Overview Check Point Research (CPR) recently discovered malware on Google Play hidden in a fake application that is capable of spreading itself via users’ WhatsApp messages. If the user downloaded…
securiCAD Vanguard in a Nutshell
securiCAD Vanguard is a cloud-native SaaS for automated threat modeling and attack simulation of AWS environments. It enables Developers, DevOps teams, and Cloud Architects and Operators to get automated, actionable insights into the cyber security posture of their AWS environments
https://docs.foreseeti.com/docs/vanguard-intro
securiCAD Vanguard is a cloud-native SaaS for automated threat modeling and attack simulation of AWS environments. It enables Developers, DevOps teams, and Cloud Architects and Operators to get automated, actionable insights into the cyber security posture of their AWS environments
https://docs.foreseeti.com/docs/vanguard-intro
RCE в Windows IPv6
https://blog.quarkslab.com/analysis-of-a-windows-ipv6-fragmentation-vulnerability-cve-2021-24086.html
По теме
https://www.systemtek.co.uk/2021/02/windows-tcp-ip-rce-and-dos-vulnerabilities-cve-2021-24074-cve-2021-24086-cve-2021-24094/
P.S. Ссылки не мои, за что спасибо приславшему✌️
https://blog.quarkslab.com/analysis-of-a-windows-ipv6-fragmentation-vulnerability-cve-2021-24086.html
По теме
https://www.systemtek.co.uk/2021/02/windows-tcp-ip-rce-and-dos-vulnerabilities-cve-2021-24074-cve-2021-24086-cve-2021-24094/
P.S. Ссылки не мои, за что спасибо приславшему✌️
Quarkslab
Analysis of a Windows IPv6 Fragmentation Vulnerability: CVE-2021-24086 - Quarkslab's blog
In this blog post we analyze a denial of service vulnerability affecting the IPv6 stack of Windows. This issue, whose root cause can be found in the mishandling of IPv6 fragments, was patched by Microsoft in their February 2021 security bulletin.
Cisco SD-WAN vManage Software Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy
Cisco
Cisco Security Advisory: Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system.
For more information about these…
For more information about these…
Cloudflare уменьшает количество используемых IPv4 адресов
Cloudflare is making infrastructure changes to simplify customer configuration, and reduce the number of IPv4 addresses that could potentially interact with your origin on Cloudflare’s behalf.
If your security model relies on allowing a list of trusted Cloudflare IPs from cloudflare.com/ips (or via API) on your origin, please make the following changes to your allow list by May 7, 2021. This change is safe to make today.
Remove:
104.16.0.0/12
Add:
104.16.0.0/13
104.24.0.0/14
This change delists the 104.28.0.0/14 prefix, which is no longer in use by Cloudflare infrastructure.
Cloudflare is making infrastructure changes to simplify customer configuration, and reduce the number of IPv4 addresses that could potentially interact with your origin on Cloudflare’s behalf.
If your security model relies on allowing a list of trusted Cloudflare IPs from cloudflare.com/ips (or via API) on your origin, please make the following changes to your allow list by May 7, 2021. This change is safe to make today.
Remove:
104.16.0.0/12
Add:
104.16.0.0/13
104.24.0.0/14
This change delists the 104.28.0.0/14 prefix, which is no longer in use by Cloudflare infrastructure.
Cloudflare
IP Ranges | Cloudflare
This page is intended to be the definitive source of Cloudflare’s current IP ranges.
Linux kernel incorrect computation of branch displacements in BPF JIT compiler can be abused to execute arbitrary code in Kernel mode
https://www.openwall.com/lists/oss-security/2021/04/08/1
https://www.openwall.com/lists/oss-security/2021/04/08/1
Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
https://us-cert.cisa.gov/ncas/alerts/aa21-008a
https://us-cert.cisa.gov/ncas/alerts/aa21-008a
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
HAProxy Forwards Over 2 Million HTTP Requests per Second on a Single Arm-based AWS Graviton2 Instance - HAProxy Technologies
https://www.haproxy.com/blog/haproxy-forwards-over-2-million-http-requests-per-second-on-a-single-aws-arm-instance/
https://www.haproxy.com/blog/haproxy-forwards-over-2-million-http-requests-per-second-on-a-single-aws-arm-instance/
HAProxy Technologies
HAProxy Exceeds 2 Million RPS on a Single Arm Instance
First ever software load balancer exceeds 2 million RPS on a single Arm instance! We're near an era where you get the world’s fastest load balancer for free.
GitHub - brad-lin/FreePSXBoot: Exploit allowing to load arbitrary code on the PSX using only a memory card (no game needed)
https://github.com/brad-lin/FreePSXBoot
https://github.com/brad-lin/FreePSXBoot
GitHub
GitHub - brad-lin/FreePSXBoot: Exploit to allow loading arbitrary code on the PSX using only a memory card (no game needed)
Exploit to allow loading arbitrary code on the PSX using only a memory card (no game needed) - brad-lin/FreePSXBoot
Malware in the AppGallery - the official app store from the Huawei Android device manufacturer
https://news.drweb.com/show/?lng=en&i=14182&c=9
https://news.drweb.com/show/?lng=en&i=14182&c=9
Dr.Web
Malware found on the AppGallery app store for the first time
Doctor Web’s virus analysts have uncovered the first malware on AppGallery―the official app store from the Huawei Android device manufacturer. They turned out to be dangerous Android.Joker trojans that function primarily to subscribe users to premium mobile…
SSD Advisory – QNAP Pre-Auth CGI_Find_Parameter RCE
https://ssd-disclosure.com/ssd-advisory-qnap-pre-auth-cgi_find_parameter-rce/
https://ssd-disclosure.com/ssd-advisory-qnap-pre-auth-cgi_find_parameter-rce/
SSD Secure Disclosure
SSD Advisory – QNAP Pre-Auth CGI_Find_Parameter RCE - SSD Secure Disclosure
TL;DR Find out how a memory corruption vulnerability can lead to a pre-auth remote code execution on QNAP QTS’s Surveillance Station plugin. Vulnerability Summary QNAP NAS with “Surveillance Station Local Display function can perform monitoring and playback…