Read Time:10 Second
Posted by Egidio Romano on Nov 29
Hello list,
Just wanted to share with you my latest blog post:
http://karmainsecurity.com/exploiting-an-nday-vbulletin-php-object-injection
Best regards,
/EgiX
Category Archives: Advisories
Win32.Ransom.Conti / Crypto Logic Flaw
Read Time:20 Second
Posted by malvuln on Nov 29
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln
Threat: Win32.Ransom.Conti
Vulnerability: Crypto Logic Flaw
Description: Conti ransomware FAILS to encrypt non PE files that have a
“.exe” in the filename. Creating specially crafted file names…
Ransomware Deception Tactics Part 1
Read Time:12 Second
Posted by malvuln on Nov 29
Did you know? some Ransomware like CONTI and others will FAIL to encrypt
non PE files that have a “.exe” in the filename.
Test.exe.docx
Test.exe.pdf
Conti MD5: 9eb9197cd58f4417a27621c4e1b25a71
ATOMSILO MD5: 5559e9f5e1645f8554ea020a29a5a3ee
Trojan.Win32.DarkNeuron.gen / Named Pipe Null DACL
Read Time:19 Second
Posted by malvuln on Nov 29
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/d891c9374ccb2a4cae2274170e8644d8.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln
Threat: Trojan.Win32.DarkNeuron.gen
Vulnerability: Named Pipe Null DACL
Family: DarkNeuron (Turla Group)
Type: PE32
MD5: d891c9374ccb2a4cae2274170e8644d8
Vuln ID: MVID-2022-0661
Disclosure: 11/24/2022…
Backdoor.Win32.Autocrat.b / Weak Hardcoded Credentials
Read Time:19 Second
Posted by malvuln on Nov 29
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/4262a8b52b902aa2e6bf02a156d1b8d4.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln
Threat: Backdoor.Win32.Autocrat.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware is packed with PeCompact, listens on TCP port 8536
and requires authentication. However, the password…
Backdoor.Win32.Serman.a / Unauthenticated Open Proxy
Read Time:19 Second
Posted by malvuln on Nov 29
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/f312e3a436995b86b205a1a37b1bf10f.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln
Threat: Backdoor.Win32.Serman.a
Vulnerability: Unauthenticated Open Proxy
Family: Serman
Type: PE32
MD5: f312e3a436995b86b205a1a37b1bf10f
Vuln ID: MVID-2022-0659
Disclosure: 11/22/2022
Description: The…
Open-Xchange Security Advisory 2022-11-24
Read Time:23 Second
Posted by Martin Heiland via Fulldisclosure on Nov 29
Dear subscribers,
we’re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne and soon
at YesWeHack.
Yours sincerely,
Martin Heiland, Open-Xchange GmbH
Product: OX App Suite
Vendor: OX Software GmbH
Internal reference: OXUIB-1654
Vulnerability type: Cross-Site Scripting…
[CVE-2022-33942] Intel Data Center Manager Console <= 4.1.1.45749 ”UserMgmtHandler" Authentication Logic Error Leading to Authentication Bypass
Read Time:25 Second
Posted by Julien Ahrens (RCE Security) on Nov 29
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Intel Data Center Manager
Vendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html
Type: Authentication Bypass by Spoofing [CWE-290]
Date found: 2022-06-01
Date published: 2022-11-23
CVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVE:…
crashing potplayer again
Read Time:27 Second
Posted by houjingyi on Nov 29
I disclosured a crash in potplayer last year :
https://seclists.org/fulldisclosure/2021/Mar/76
And I found a new one this year, this time is a mid file. Again I contacted
Korea Internet & Security Agency(first-team () krcert or kr), they shared
report to the onwer of the potplayer, Kakao Corp as they said. But I did
not get any update after about half a year. So this is a 0day.
I cannot debug or get any useful information about the crash…
USN-5745-2: shadow regression
Read Time:29 Second
USN-5745-1 fixed vulnerabilities in shadow. Unfortunately that update
introduced a regression that caused useradd to behave incorrectly in Ubuntu
14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This
update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
Florian Weimer discovered that shadow was not properly copying and removing
user directory trees, which could lead to a race condition. A local attacker
could possibly use this issue to setup a symlink attack and alter or remove
directories without authorization.