Android Deep Link issues and WebView Exploitation https://8ksec.io/android-deeplink-and-webview-exploitation-8ksec-blogs/
8kSec
Android Deep Links & WebView Exploitation | 8kSec
In this Blog post, learn about Android deep link and WebView issues, explaining their targets, exploitation and security measures. Read now
New Vulnerability: PaperCut MF/NG https://www.greynoise.io/blog/new-vulnerability-papercut-mf-ng
www.greynoise.io
New Vulnerability: PaperCut MF/NG | GreyNoise Blog
CISA added CVE-2023-27350 (a critical unauthenticated remote code execution vulnerability) impacting PaperCut MF and PaperCut NG to the Known Exploited Vulnerabilities (KEV) list. PaperCut MF and PaperCut NG are both enterprise printer management software.
Git Arbitrary Configuration Injection (CVE-2023-29007) https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007
Ethiack
Git Arbitrary Configuration Injection (CVE-2023-29007)
CVE-2023-29007 | Git’s implementation was used to rename or delete sections of a configuration file containing a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections. When attempting to…
Spoofing Call Stacks To Confuse EDRs https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs
A Deep Learning Approach for Password Guessing (https://arxiv.org/abs/1709.00440) https://github.com/brannondorsey/PassGAN
GitHub
GitHub - brannondorsey/PassGAN: A Deep Learning Approach for Password Guessing (https://arxiv.org/abs/1709.00440)
A Deep Learning Approach for Password Guessing (https://arxiv.org/abs/1709.00440) - brannondorsey/PassGAN
Evasive Panda APT group delivers malware via updates for popular Chinese software https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/
Welivesecurity
Evasive Panda APT group delivers malware via updates for popular Chinese software
ESET Research uncovers a campaign by the APT group known as Evasive Panda targeting an international NGO in China with malware delivered through updates of popular Chinese software
Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 https://qriousec.github.io/post/vbox-pwn2own-2023/
Qrious Secure
Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991
Introduction Hi, I am Trung (xikhud). Last month, I joined Qrious Secure team as a new member, and my first target was to find and reproduce the security bugs that @bienpnn used at the Pwn2Own Vancouver 2023 to escape the VirtualBox VM.
Since VirtualBox is…
Since VirtualBox is…
Unpacking BellaCiao: A Closer Look at Iran’s Latest Malware https://www.bitdefender.com/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware/
Bitdefender Blog
Unpacking BellaCiao: A Closer Look at Iran’s Latest Malware
With recent reports that Charming Kitten group (aka Mint Sandstorm) is actively targeting critical infrastructure in the US and other countries, we would like to share the most recent insights from Bitdefender Labs about modernization of Charming Kitten’s…
Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html
AtomLdr: DLL loader with advanced evasive features https://securityonline.info/atomldr-dll-loader-with-advanced-evasive-features/
usd-2022-0034 | Privilege Escalation in Microsoft Windows https://herolab.usd.de/security-advisories/usd-2022-0034/
usd HeroLab
Security Advisory usd-2022-0034 | usd HeroLab
Advisory ID: usd-2022-0034 | Product: Microsoft Windows | Vulnerability Type: Improper Link Resolution Before File Access (CWE-59)
Finding XSS in a million websites (cPanel CVE-2023-29489) https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/total-identity-compromise-microsoft-incident-response-lessons-on/ba-p/3753391
TECHCOMMUNITY.MICROSOFT.COM
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory | Microsoft Community Hub
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory
When Microsoft Incident Response (formerly DART/CRSP) is...
When Microsoft Incident Response (formerly DART/CRSP) is...
👍1
Breaking out of Docker via runC – Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/
Unit 42
Breaking out of Docker via runC – Explaining CVE-2019-5736
Last week (2019-02-11) a new vulnerability in runC was reported by its maintainers, originally found by Adam Iwaniuk and Borys Poplawski. Dubbed
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/
STAR Labs
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)
Introduction While analyzing CVE-2022-41082, also known as ProxyNotShell, we discovered this vulnerability which we have detailed in this blog. However, for a comprehensive understanding, we highly recommend reading the thorough analysis written by team ZDI.…
Silicon Shellcode Emulator Introduction (a lightweight x86/x64 emulator designed for Windows shellcode) https://www.youtube.com/watch?v=8gT2DhwqWqU
YouTube
Silicon Shellcode Emulator Introduction
A lightweight x86/x64 emulator designed for Windows shellcode.
More information at: https://cerbero.io
More information at: https://cerbero.io
PowerShell Malware with x64 Shellcode https://blog.cerbero.io/?p=2682
Exploiting the notoriously unsafe gets() on a PAC-protected ARM64 binary https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/
RET2 Systems Blog
The Oddest Place You Will Ever Find PAC
The latest efforts to harden software against exploitable memory corruption vulnerabilities come in the form of hardware-assisted control flow integrity and ...
The ARM32 Scheduling and Kernelspace/Userspace Boundary https://people.kernel.org/linusw/the-arm32-scheduling-and-kernelspace-userspace-boundary
linusw
The ARM32 Scheduling and Kernelspace/Userspace Boundary — linusw
As of recent I needed to understand how the ARM32 architecture switches control of execution between normal, userspace processes and the ...