/ Remote code execution flaw patched in Apache Kafka
https://portswigger.net/daily-swig/remote-code-execution-flaw-patched-in-apache-kafka
https://portswigger.net/daily-swig/remote-code-execution-flaw-patched-in-apache-kafka
The Daily Swig | Cybersecurity news and views
Remote code execution flaw patched in Apache Kafka
Possible RCE and denial-of-service issue discovered in Kafka Connect
/ ClamAV fixed a possible remote code execution vulnerability
https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html
https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html
blog.clamav.net
ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published
Today, we are releasing the following critical patch versions for ClamAV: 0.103.8 0.105.2 1.0.1 ClamAV 0.104 has reached end-of-life accord...
/ Hijack Explorer Context Menu for Persistence & Fun
Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder:
— https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html
Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder:
— https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html
ristbs’s blog
Hijack Explorer Context Menu for Persistence & Fun
Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder.
/ Atlassian Data Leak 🤦
Atlassian has confirmed that a breach at a "third-party vendor" caused a recent leak of company data and that their network and customer information..:
https://www.bleepingcomputer.com/news/security/atlassian-says-recent-data-leak-stems-from-third-party-vendor-hack/
Atlassian has confirmed that a breach at a "third-party vendor" caused a recent leak of company data and that their network and customer information..:
https://www.bleepingcomputer.com/news/security/atlassian-says-recent-data-leak-stems-from-third-party-vendor-hack/
BleepingComputer
Atlassian data leak caused by stolen employee credentials
Atlassian has confirmed that a breach at a third-party vendor caused a recent leak of company data and that their network and customer information is secure.
/ Malware Abuses Microsoft IIS Feature to Establish Backdoor
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/frebniis-malware-iis
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/frebniis-malware-iis
Security
Frebniis: New Malware Abuses Microsoft IIS Feature to Establish Backdoor
Malware injects malicious code into Failed Request Event Buffering module in order to monitor HTTP requests from attacker.
/ Account Takeover Vulnerability in a Popular Package, Affecting 1000+ Organizations
illustria’s research team finds a popular npm package with nearly 4 million weekly downloads, vulnerable to account takeover attack..:
https://blog.illustria.io/illustria-discovers-account-takeover-vulnerability-in-a-popular-package-affecting-1000-8aaaf61ebfc4?gi=10ee34fdeff8
illustria’s research team finds a popular npm package with nearly 4 million weekly downloads, vulnerable to account takeover attack..:
https://blog.illustria.io/illustria-discovers-account-takeover-vulnerability-in-a-popular-package-affecting-1000-8aaaf61ebfc4?gi=10ee34fdeff8
Medium
illustria Discovers Account Takeover Vulnerability in a Popular Package, Affecting 1000+ Organizations
illustria’s research team finds a popular npm package with nearly 4 million weekly downloads, vulnerable to account takeover attack.
/ Dirty bug in HAProxy's headers processing, and that, when properly exploited, this bug allows to build an HTTP content smuggling attack
HAProxy Security Update (CVE-2023-25725)
https://www.mail-archive.com/haproxy@formilux.org/msg43229.html
HAProxy Security Update (CVE-2023-25725)
https://www.mail-archive.com/haproxy@formilux.org/msg43229.html
/ GoDaddy > GoHacked
Official statement on recent website redirect issues:
https://aboutus.godaddy.net/newsroom/company-news/news-details/2023/Statement-on-recent-website-redirect-issues/default.aspx
Official statement on recent website redirect issues:
https://aboutus.godaddy.net/newsroom/company-news/news-details/2023/Statement-on-recent-website-redirect-issues/default.aspx
aboutus.godaddy.net
Statement on recent website redirect issues
In early December 2022, we started receiving a small number of customer complaints about their websites being intermittently redirected. Upon receiving these complaints, we investigated and found that the intermittent redirects were happening on seemingly…
/ Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS
https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-advanced-research-center-discovers-a-new-privilege-escalation-bug-class-on-macos-and-ios.html
https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-advanced-research-center-discovers-a-new-privilege-escalation-bug-class-on-macos-and-ios.html
Trellix
Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS
The Trellix Advanced Research Center vulnerability team has discovered a large new class of bugs that allow bypassing code signing to execute arbitrary code in the context of several platform applications, leading to escalation of privileges and sandbox escape…
/ QR code generator My QR Code leaks users’ login data and addresses
https://www.hackread.com/qr-code-generator-my-qr-code-data-leak/
https://www.hackread.com/qr-code-generator-my-qr-code-data-leak/
Hackread
QR code generator My QR Code leaks users’ login data and addresses
MyQRcode, a popular Sofia, Bulgaria-based QR code generator website, is leaking the personal data of its users. Read more for details!
/ VMware Carbon Black App Control updates address an injection vulnerability (CVE-2023-20858)
Hight
https://www.vmware.com/security/advisories/VMSA-2023-0004.html
Hight
https://www.vmware.com/security/advisories/VMSA-2023-0004.html
/ VMware ESXi 7.0 Update 3k Release Notes
Critical patch
https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-esxi-70u3k-release-notes.html#resolvedissues
Critical patch
https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-esxi-70u3k-release-notes.html#resolvedissues
/ CISA Adds Three Known Exploited Vulnerabilities to Catalog
..These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise..:
https://www.cisa.gov/uscert/ncas/current-activity/2023/02/21/cisa-adds-three-known-exploited-vulnerabilities-catalog
..These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise..:
https://www.cisa.gov/uscert/ncas/current-activity/2023/02/21/cisa-adds-three-known-exploited-vulnerabilities-catalog
/ Analysis of the WinorDLL64 payload
WinorDLL64 payload serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, such as exfiltrating, overwriting, and removing files, and executes additional commands..:
https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/
WinorDLL64 payload serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, such as exfiltrating, overwriting, and removing files, and executes additional commands..:
https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/
WeLiveSecurity
WinorDLL64: A backdoor from the vast Lazarus arsenal?
ESET researchers uncover the WinorDLL64 backdoor, one of the payloads of the Wslink downloader and probably part of Lazarus' arsenal.
/ Evasive cryptojacking malware targeting macOS found lurking in pirated applications
https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/
https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/
Jamf
Beware of macOS cryptojacking malware.
You may have heard about the cryptojacking malware on macOS. Read about a new one spotted by Jamf Threat Labs.
/ Bypassing Akamai’s Web Application Firewall Using an Injected Content-Encoding Header
https://www.praetorian.com/blog/using-crlf-injection-to-bypass-akamai-web-app-firewall/
https://www.praetorian.com/blog/using-crlf-injection-to-bypass-akamai-web-app-firewall/
/ How NPM Packages Were Used to Spread Phishing Links
https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishing-links/
https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishing-links/
Checkmarx
How NPM Packages Were Used to Spread Phishing Links
On Monday, 20th of February, Checkmarx Labs discovered an anomaly in the NPM ecosystem when we cross-referenced new information with our databases. Clusters of packages had been published in large quantities to the NPM package manager.
/ Researchers find hidden vulnerabilities in hundreds of Docker containers
..a note about not trusting containers from docker hub..:
— https://www.helpnetsecurity.com/2023/02/23/hidden-vulnerabilities-docker-containers/
..a note about not trusting containers from docker hub..:
— https://www.helpnetsecurity.com/2023/02/23/hidden-vulnerabilities-docker-containers/
Help Net Security
Researchers find hidden vulnerabilities in hundreds of Docker containers
Rezilion uncovered the presence of hundreds of Docker containers containing vulnerabilities undetected by vulnerability scanners.
/ New WhiteSnake Stealer Offered for Sale Via MaaS Model
A Stealer Capable of Targeting Both Windows and Linux Users..
— https://blog.cyble.com/2023/02/24/new-whitesnake-stealer-offered-for-sale-via-maas-model/
A Stealer Capable of Targeting Both Windows and Linux Users..
— https://blog.cyble.com/2023/02/24/new-whitesnake-stealer-offered-for-sale-via-maas-model/
Cyble
Cyble - New WhiteSnake Stealer Offered For Sale Via MaaS Model
Cyble Research & Intelligence Labs analyzes WhiteSnake, a new Information Stealer targeting Windows and Linux users via the MaaS model.