Security Affairs

JUNE 16, 2022

Researchers disclosed a remote code execution vulnerability, tracked as CVE-2022-25845, in the popular Fastjson library. Cybersecurity researchers from JFrog disclosed details of a now patched high-severity security vulnerability in the popular Fastjson library that could be potentially exploited to achieve remote code execution.

Libraries 74

Libraries Cybersecurity Security IT 74

Security Affairs

AUGUST 26, 2021

Cybersecurity and Infrastructure Security Agency (CISA) released five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices. CISA published five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices. ” reads CISA’s advisory.

Security 130

Security Authentication Libraries Passwords 130

Security Affairs

JULY 8, 2019

The developer Tute Costa found a backdoor in the Ruby library during regular security audits before deploying his code in the production environment. The developer Tute Costa found a backdoor in the Ruby library during regular security audits. The attacker created a new version of the library (version 0.0.7

Libraries 80

Libraries Passwords Security IT 80

Security Affairs

APRIL 21, 2024

The threat actors behind the DuneQuixote campaign took steps to prevent collection and analysis the implants through the implementation of practical and well-designed evasion methods. The malware is developed in C/C++ without utilizing the Standard Template Library (STL), and certain segments are coded in pure Assembler.”

Libraries 97

Libraries Communications IT Government 97

Security Affairs

DECEMBER 20, 2023

The flaw was reported by Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group on 2023-12-19 and fixed in just one day. Reported by Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group on 2023-12-19” reads the advisory published by the IT giant. ” continues the advisory.

Libraries 114

Libraries Access IT Information Security 114

Security Affairs

APRIL 2, 2024

Researchers from the firmware security firm Binarly released a free online scanner to detect the CVE-2024-3094 Backdoor Last week, Microsoft engineer Andres Freund discovered a backdoor issue in the latest versions of the “xz” tools and libraries. The vulnerability was tracked as CVE-2024-3094 and received a CVSS score of 10.

Authentication 119

Authentication Libraries Access Security 119

Security Affairs

MAY 1, 2024

Since then, it has gained popularity among statisticians and data miners for its powerful features and extensive libraries for data manipulation, visualization, and statistical analysis. ” reads the analysis published by HiddenLayer. ” continues the analysis.

Metadata 110

Metadata Libraries Access IT 110

Security Affairs

NOVEMBER 29, 2023

Google on Wednesday released security updates to address a new actively exploited zero-day, tracked as CVE-2023-6345, in the Chrome browser. Skia is an open-source 2D graphics library that provides common APIs that work across a variety of hardware and software platforms. The CVE-2023-5217 is a high-severity integer overflow in Skia.

Libraries 115

Libraries Security Access IT 115

Security Affairs

JANUARY 21, 2024

Each pirated application included the following components: Malicious dylib , a library loaded by the application that acts as a dropper. ” reads the analysis published by Jamf. ” reads the analysis published by Jamf. ” continues the analysis. log” from a remote server.

Libraries 127

Libraries IT Information Security Security 127

Security Affairs

MARCH 11, 2024

However, they focused on the analysis of the details included in the advisory. ” reads the analysis published by Horizon3.ai. “The connect() method interestingly loads a native system library, auth.dll, and eventually calls the authorizeUser() method defined in it. . ” reads the analysis published by Horizon3.ai.

Authentication 115

Authentication Passwords Libraries Access 115

Security Affairs

DECEMBER 6, 2022

The encryption and decryption are not robust and the ransomware lack features like Windows Shadow Copy removal, File unlocking for a more thorough impact, Anti-analysis, and Defensive evasion (AMSI bypass, disabling event logging, etc.). ” reads the analysis published by Fortinet.

Ransomware 125

Ransomware Encryption Libraries IT 125

Security Affairs

APRIL 28, 2024

The payload includes a dynamic-link library (vpn.sessings) that injects the post-exploitation tool Cobalt Strike Beacon into memory and awaits commands from the C2 server. The DLL also implements features to evade detection and avoid analysis by security experts. Threat actors used a cracked version of Cobalt Strike.

Military 112

Military Mining Libraries Security 112

Security Affairs

JULY 7, 2022

” reads the analysis published by the experts. “Unlike other threats that hijack shared libraries by modifying the environment variable LD_PRELOAD, this malware uses 2 different ways to load the malicious library. The experts pointed out that the malware outstands for its almost hermetic hooking of libraries.

Libraries 126

Libraries Cybersecurity Authentication Access 126

Security Affairs

MARCH 16, 2023

Exploitation of this vulnerability allowed malicious actors to successfully execute remote code on a federal civilian executive branch (FCEB) agency’s Microsoft Internet Information Services (IIS) web server.” The joint alert recommends network defenders review the Malware Analysis Report, MAR-10413062-1.v1

Libraries 82

Libraries Government Ransomware Cybersecurity 82

Security Affairs

APRIL 19, 2023

The vulnerability is an Integer overflow in the Skia graphics library, the issue was reported by Clément Lecigne of Google’s Threat Analysis Group on April 12, 2023. Reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-04-12 [$1000][ 1430644 ] Medium CVE-2023-2137: Heap buffer overflow in sqlite.

Libraries 90

Libraries Education Access Cybersecurity 90

Security Affairs

DECEMBER 1, 2023

The two issues are: CVE-2023-6345 Google Skia Integer Overflow Vulnerability CVE-2023-49103 ownCloud graphapi Information Disclosure Vulnerability CVE-2023-6345 – The CVE-2023-5217 is a high-severity integer overflow in Skia. Benoît Sevens and Clément Lecigne of Google’s Threat Analysis Group discovered the zero-day on on 2023-11-24.

IT 92

IT Libraries Cybersecurity Passwords 92

Security Affairs

NOVEMBER 2, 2022

The OpenSSL project fixed two high-severity flaws in its cryptography library that can trigger a DoS condition or achieve remote code execution. The OpenSSL project has issued security updates to address a couple of high-severity vulnerabilities, tracked as CVE-2022-3602 and CVE-2022-3786 , in its cryptography library.

Libraries 105

Libraries Encryption Authentication Communications 105

Security Affairs

MAY 22, 2022

The expert discovered a post where a researcher were sharing a fake Proof of Concept (POC) exploit code for an RPC Runtime Library Remote Code Execution flaw ( CVE-2022-26809 CVSS 9.8). The analysis of the malware revealed that it is a.Net binary packed with ConfuserEX , a free, open-source protector for.NET applications.

Libraries 141

Libraries Information Security Cybersecurity Security 141

Security Affairs

SEPTEMBER 28, 2023

The vulnerability was discovered by Clément Lecigne from Google’s Threat Analysis Group on 2023-09-25, a circumstance that suggests it was exploited by a nation-state actor or by a surveillance firm. Reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-09-25″ reads the advisory published by Google.

Libraries 112

Libraries Passwords Security IT 112

Security Affairs

DECEMBER 1, 2022

The attacking server that is defined as the master uses this connection to download the shared library exp_lin.so MODULE LOAD command – this allows for the loading of a module from the dynamic library downloaded at stage 4 at runtime. This library allows for exploitation of the vulnerability and runs arbitrary commands later.

Libraries 142

Libraries Honeypots Communications Cybersecurity 142

Security Affairs

JULY 8, 2023

CVE-2023-26083 CVE-2021-29256 CVE-2023-2136 The CVE-2023-26083 is an Arm Mali GPU kernel driver information disclosure vulnerability that the US CISA added to its Known Exploited Vulnerabilities catalog in April 2023. The flaw was reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-04-12.

Libraries 95

Libraries Security Access IT 95

Security Affairs

MARCH 28, 2024

Google’s Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively exploited zero-day vulnerabilities in 2023. In 2023, the researchers observed a surge in zero-day vulnerabilities in third-party components and libraries that can impact all products that use them.

Government 111

Government Ransomware Libraries Access 111

Security Affairs

NOVEMBER 17, 2020

Shellcode play an essential role in cyber attacks, the popular expert Unixfreaxjp explained how to utilize radare2 for variation of shellcode analysis. A good analysis tool can help you dissect a shellcode if the low-level language analysis operation is supported, as any shellcode is coded in assembly language.

Libraries 111

Libraries IT Security Information Security 111

ForAllSecure

JUNE 7, 2023

Hartford CyberSecurity Summit Get ready for the very first Hartford Cyber Security Summit, where C-Suite and Senior Executives responsible for protecting their companies' critical infrastructures will connect with innovative solution providers and renowned information security experts.

Libraries 52

Libraries Sales Cybersecurity Education 52

Security Affairs

DECEMBER 12, 2021

Immediately after the disclosure of the Log4Shell flaw in Log4j library threat actors started including the exploit code in Linux botnets. Researchers at NetLab 360 reported that their Anglerfish and Apacket honeypots were already hit by attacks attempting to trigger the Log4Shell flaw in the Log4j library.

Honeypots 135

Honeypots Libraries Authentication Passwords 135

Security Affairs

JUNE 6, 2023

The vulnerability was discovered by Clement Lecigne of Google’s Threat Analysis Group (TAG), which is the team at Google that monitors the activity of nation-state actors. The vulnerability is a type confusion issue that resides in the V8 JavaScript engine.

Libraries 89

Libraries Security IT Information Security 89

Security Affairs

JUNE 25, 2022

The malicious packages, which were reported to PyPI, are: loglib-modules — appears to target developers familiar with the legitimate ‘loglib’ library. pyg-modules — appears to target developers familiar with the legitimate ‘pyg’ library. ” continues the analysis. com:8000/upload. another.

Libraries 92

Libraries Metadata Security IT 92

Security Affairs

APRIL 22, 2023

The vulnerability is an Integer overflow in the Skia graphics library, the issue was reported by Clément Lecigne of Google’s Threat Analysis Group on April 12, 2023. CVE-2023-2136 – Google Chrome Skia Integer Overflow Vulnerability.

IT 90

IT Libraries Cybersecurity Education 90

Security Affairs

JANUARY 28, 2021

The activity of the TeamTNT group has been detailed by security firm Trend Micro, but in August experts from Cado Security discovered that that botnet is also able to target misconfigured Kubernetes installations. The open-source tool is deployed within a base64 encoded script hidden in the TeamTNT cryptominer binary or ircbot.

IT 120

IT Libraries Mining Security 120

Security Affairs

NOVEMBER 25, 2022

Researchers discovered that devices from Dell, HP, and Lenovo are still using outdated versions of the OpenSSL cryptographic library. Binarly researchers discovered that devices from Dell, HP, and Lenovo are still using outdated versions of the OpenSSL cryptographic library. ” continues the report. that dates back to 2009.

Libraries 100

Libraries Manufacturing Communications Security 100

Security Affairs

JANUARY 28, 2024

The vulnerability was reported by the researcher Yaniv Nizry from Sonar who wrote a detailed analysis of the issue. The open-source software uses the args4j library to parse CLI command arguments and options on the Jenkins controller.

Libraries 127

Libraries Authentication IT Access 127

Security Affairs

OCTOBER 23, 2021

CISA warned of crypto-mining malware hidden in a popular JavaScript NPM library, named UAParser.js, which has millions of weekly downloads. Cybersecurity and Infrastructure Security Agency published an advisory to warn of the discovery of a crypto-mining malware in the popular NPM Package UAParser.js.

Mining 133

Mining Libraries Cybersecurity Security 133

IT Governance

NOVEMBER 6, 2023

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. Library branches remain open, Wi-Fi is still available and materials can still be borrowed. As of the publication of this blog post, the Library’s website remains offline.

Data Privacy 97

Data Privacy Privacy Libraries Security 97

Security Affairs

JULY 2, 2022

The unauthenticated remote code execution vulnerability was discovered by security researcher Naveen Sunkavally at Horizon3.ai The issue was discovered while investigating an endpoint managed by the CewolfRenderer servlet in the third-party Cewolf charting library. ” continues the analysis.

Libraries 97

Libraries Authentication Security Access 97

Security Affairs

JULY 1, 2020

The malware was also analyzed by Malwarebytes Director of Mac & Mobile Thomas Reed , Principal Security Researcher at Jamf Patrick Wardle , and Phil Stokes , macOS security researcher at SentinelOne. ” reads the analysis wrote by Wardle. The ransomware also checks for some common anti-virus solutions (e.g.

Ransomware 120

Ransomware Libraries Encryption Communications 120

Security Affairs

DECEMBER 13, 2021

Threat actors are already abusing Log4Shell vulnerability in the Log4j library for malicious purposes such as deploying malware. A few hours ago, researchers at NetLab 360 reported that their Anglerfish and Apacket honeypots were already hit by attacks attempting to trigger the Log4Shell flaw in the Log4j library. Pierluigi Paganini.

Mining 120

Mining Honeypots Libraries IT 120

Security Affairs

JUNE 26, 2023

” reads the analysis published by the company. ” The analysis of the Apache Tomcat access logs revealed the execution of multiple HTTP POST requests to /html/promotion/selfsdp.jspx, which is a web shell used by the threat actors. ” concludes the report.

Cleanup 79

Cleanup Libraries Access Manufacturing 79