ChatGPT Vulnerable to Prompt Injection via YouTube Transcripts https://www.tomshardware.com/news/chatgpt-vulnerable-to-youtube-prompt-injection
Tom's Hardware
ChatGPT Vulnerable to Prompt Injection via YouTube Transcripts
Ask a plugin to summarize a video and you could get more than you bargained for.
CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability https://github.com/dhmosfunk/CVE-2023-25690-POC
GitHub
GitHub - dhmosfunk/CVE-2023-25690-POC: CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server…
CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability. - dhmosfunk/CVE-2023-25690-POC
The Underground History of Russia’s Most Ingenious Hacker Group https://www.wired.com/story/turla-history-russia-fsb-hackers/
🤨2
Typical vulnerabilities in lending and CDP protocols https://blog.decurity.io/typical-vulnerabilities-in-lending-and-cdp-protocols-e778e540e215
Medium
Typical vulnerabilities in lending and CDP protocols
This article explains the security of a popular pattern in the decentralized finance — the CDP (collateralized debt position)
👌1
React Router Version 6 Tutorial – How to Set Up Router and Route to Other Components https://www.freecodecamp.org/news/how-to-use-react-router-version-6/
freeCodeCamp.org
React Router Version 6 Tutorial – How to Set Up Router and Route to Other Components
In this tutorial, we'll talk about what React Router is and how to use it. Then we'll discuss its features and how to use them in your React app to navigate to and render multiple components. Prerequisites A React app A good understanding of what c...
Trusted publishing: a new benchmark for packaging security https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/
The Trail of Bits Blog
Trusted publishing: a new benchmark for packaging security
Read the official announcement on the PyPI blog as well! For the past year, we’ve worked with the Python Package Index to add a new, more secure authentication method called “trusted publishing.” Trusted publishing eliminates the need for long-lived API tokens…
Compromised from Within: The Unauthorized Restoration of TorGuard’s Telegram Channel https://medium.com/@TorGuard/compromised-from-within-the-unauthorized-restoration-of-torguards-telegram-channel-dce4c5836
Medium
Compromised from Within: The Unauthorized Restoration of TorGuard’s Telegram Channel
This is the comprehensive, substantiated account of how TorGuard’s deleted Telegram Channel was improperly resurrected and handed over to a…
🔥1
Exploring P4 Protocol: Usage, Implementation, and CVE-2021-37535 https://redrays.io/exploring-p4-protocol-usage-implementation-and-cve-2021-37535/
RedRays - Your SAP Security Solution
Exploring P4 Protocol: Usage, Implementation, and CVE-2021-37535
Explore the P4 protocol's role in Java remote communication, its implementation, and security features. Understand its use in JNDI, RMI, and distributed systems. Dive into the CVE-2021-37535 vulnerability resolution for safer Java applications.
Salt Labs exposes a new vulnerability in popular OAuth framework, used in hundreds of online services https://salt.security/blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
salt.security
New OAuth Vulnerability Impacts Hundreds of Online Services
OAuth vulnerability earns CVE-2023-28131. Salt exposes a new vulnerability in the popular OAuth framework, used in hundreds of online services.
Introduction to the Z3 Solver framework with the Hex-Rays CTF Challenge 2023 https://www.youtube.com/watch?v=kZd1Hi0ZBYc
YouTube
Introduction to the Z3 Solver framework with the Hex-Rays CTF Challenge 2023
This CTF challenge from Hex-Rays presents a very good opportunity to introduce you to the Z3 framework.
In this video, we will solve the CTF challenge with the absolute beginners in mind.
- https://hex-rays.com/blog/free-madame-de-maintenon-ctf-challenge/…
In this video, we will solve the CTF challenge with the absolute beginners in mind.
- https://hex-rays.com/blog/free-madame-de-maintenon-ctf-challenge/…
Cloud-Based Malware Delivery: The Evolution of GuLoader https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/
Check Point Research
Cloud-Based Malware Delivery: The Evolution of GuLoader - Check Point Research
Key takeaways Introduction Antivirus products are constantly evolving to become more sophisticated and better equipped to handle complex threats. As a result, malware developers strive to create new threats that can bypass the defenses of antivirus products.…
Future Exploitation Vector: File Extensions as Top-Level Domains https://www.trendmicro.com/en_us/research/23/e/future-exploitation-vector-file-extensions-as-top-level-domains.html
Trend Micro
Future Exploitation Vector File Extensions as Top Level Domains
In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains (TLDs) while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards.
Future Exploitation Vector: File Extensions as Top-Level Domains https://www.trendmicro.com/en_us/research/23/e/future-exploitation-vector-file-extensions-as-top-level-domains.html
Trend Micro
Future Exploitation Vector File Extensions as Top Level Domains
In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains (TLDs) while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards.
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) https://status.barracuda.com/incidents/34kx82j5n4q9
Barracuda
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023.
Barracuda Networks's Status Page - Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023..
Rooting with root cause: finding a variant of a Project Zero bug https://github.blog/2023-05-25-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug/
The GitHub Blog
Rooting with root cause: finding a variant of a Project Zero bug
In this blog, I’ll look at CVE-2022-46395, a variant of CVE-2022-36449 (Project Zero issue 2327), and use it to gain arbitrary kernel code execution and root privileges from the untrusted app domain on an Android phone that uses the Arm Mali GPU. I’ll also…
Debugging the Windows Kernel and Undocumented Structures https://twitter.com/Steph3nSims/status/1662156705457909760?s=20
Nice series here >> Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells) https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/ (and good summary map in https://pberba.github.io/assets/posts/common/20220201-linux-persistence.pdf)
pepe berba
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)
An introduction to monitoring and logging in linux to look for persistence.
🔥1
Man-in-the-Middle Attacks without Rogue AP:
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf