Security Affairs

DECEMBER 12, 2023

Successful exploitation of the flaw may lead to arbitrary code execution. Apple also addressed a code execution flaw, tracked as CVE-2023-42890, in the WebKit. Processing web content may lead to arbitrary code execution. The IT giant addressed the flaw by improving memory handling.

Security 117

Security IT Information Security 117

Security Affairs

NOVEMBER 30, 2022

Google’s Threat Analysis Group (TAG) linked three exploitation frameworks to a Spanish surveillance spyware vendor named Variston. While tracking the activities of commercial spyware vendors, Threat Analysis Group (TAG) spotted an exploitation framework likely linked Variston IT, a Spanish firm. ” TAG concludes.

Archiving 103

Archiving Risk Government IT 103

Security Affairs

APRIL 2, 2024

“When viewed by an administrator, the malicious code is executed in the context of the administrator’s browser session and allows for the creation of malicious administrator users as well as changes to an affected site’s settings which could lead to a complete site takeover.” ” reads the advisory published by Wordfence.

Access 126

Access IT Information Security Security 126

Security Affairs

APRIL 13, 2022

The remote code execution flaw, tracked as CVE-2020-17530, resides in forced OGNL evaluation when evaluated on raw user input in tag attributes. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution – similar to S2-059.”

Cybersecurity 138

Cybersecurity Security IT Information Security 138

Security Affairs

OCTOBER 18, 2022

HelpSystems, the company that developed the Cobalt Strike platform, addressed a critical remote code execution vulnerability in its software. HelpSystems, the company that developed the commercial post-exploitation toolkit Cobalt Strike, addressed a critical remote code execution vulnerability, tracked as CVE-2022-42948, in its platform.

IT 114

IT Security Information Security 114

Security Affairs

MARCH 19, 2021

Experts found vulnerabilities in two WordPress plugins that could be exploited to run arbitrary code and potentially take over a website. Security researchers disclosed vulnerabilities in Elementor and WP Super Cache WordPress plugins that could be exploited to run arbitrary code and take over a website under certain circumstances.

Authentication 132

Authentication Security Access IT 132

Security Affairs

JULY 23, 2023

Update on CVE-2023-3519 vulnerable IPs: we now tag 15K Citrix IPs as vulnerable to CVE-2023-3519. We extended the tagging logic to tag as vulnerable all that return Last Modified headers with a date before July 1, 2023 00:00:00Z. reads the advisory published by CISA. “In We also improved NetScaler AAA detection coverage.

Cybersecurity 97

Cybersecurity Cloud Encryption Passwords 97

Security Affairs

DECEMBER 8, 2020

The Apache Software Foundation addressed a possible remote code execution vulnerability in Struts 2 related to the OGNL technology. . The Apache Software Foundation has released a security update to address a “possible remote code execution” flaw in Struts 2 that is related to the OGNL technology. . ” Pierluigi Paganini.

Cybersecurity 111

Cybersecurity Security IT Information Security 111

Security Affairs

OCTOBER 25, 2023

The analysis of the email HTML source code revealed the presence of a SVG tag at the end, which contains a base64-encoded payload. The messages were sent from team.managment@outlook[.]com com and had the subject Get started in your Outlook. ” reads the analysis published by ESET. ” reads the analysis published by ESET.

Military 119

Military Government Phishing IT 119

Security Affairs

DECEMBER 8, 2022

” reads the post published by TAG. TAG determined that the APT group abused the zero-day vulnerability in the JScript engine of Internet Explorer. An attacker can exploit the flaw to execute arbitrary code when the victim visits an attacker-controlled website. CVE-2017-0199 ). Pierluigi Paganini.

IT 99

IT Security Information Security 99

Security Affairs

JANUARY 3, 2024

The fact that the issue was discovered by Google TAG suggests it was exploited by a nation-state actor or by a surveillance firm. CVE-2023-7101 – The flaw is Spreadsheet::ParseExcel Remote Code Execution Vulnerability. Google released emergency updates to address this zero-day vulnerability.

Libraries 117

Libraries IT Cybersecurity Risk 117

Security Affairs

JULY 13, 2023

.” The vulnerability is reflected Cross-Site Scripting (XSS) that was discovered by Clément Lecigne of Google Threat Analysis Group (TAG). Google TAG researchers focus on identifying and countering advanced and persistent threats. Thank you to @Zimbra for publishing this advisory and mitigation advice!

Authentication 96

Authentication Cloud Security IT 96

Security Affairs

OCTOBER 12, 2023

Researchers from the Akamai Security Intelligence Group uncovered a Magecart web skimming campaign that is manipulating the website’s default 404 error page to hide malicious code. ” The attack chain of this campaign consists of three main parts: loader, malicious attack code, and data exfiltration. .

Retail 115

Retail IT Security Information Security 115

Security Affairs

JUNE 24, 2022

Google’s Threat Analysis Group (TAG) revealed that the Italian spyware vendor RCS Labs was supported by ISPs to spy on users. TAG researchers tracked more than 30 vendors selling exploits or surveillance capabilities to nation-state actors. ” continues the analysis. Follow me on Twitter: @securityaffairs and Facebook.

Government 120

Government Security IT Information Security 120

Security Affairs

JUNE 5, 2023

Magecart attacks target e-commerce websites, the name “Magecart” is derived from the malicious code (JavaScript) typically injected by the attackers into compromised websites. The attack chain commences by scanning the web for vulnerable legitimate sites and hacking them to inject malicious code.

CMS 85

CMS Retail Analytics IT 85

Security Affairs

AUGUST 31, 2023

Because we can override files using the IO_REPARSE_TAG_WCI_1 reparse tag without the detection of antivirus drivers, their detection algorithm will not receive the whole picture and thus will not trigger.” Scan files with the tag in the PRE_CLEANUP function even if they were not altered. ” continues the report.

Security 125

Security Ransomware Communications IT 125

Security Affairs

NOVEMBER 12, 2021

Google TAG researchers discovered that threat actors leveraged a zero-day vulnerability in macOS in a watering hole campaign aimed at delivering malware to users in Hong Kong. “To protect our users, TAG routinely hunts for 0-day vulnerabilities exploited in-the-wild. The macOS exploits were different from the iOS ones.

Encryption 139

Encryption IT Security Information Security 139

Security Affairs

DECEMBER 14, 2022

The malicious HTML code is generated within the browser on the target device which is already inside the security perimeter of the victim’s network. . “SVG images are constructed using XML, allowing them to be placed within HTML using ordinary XML markup tags. ” reads the analysis published by Talos.

Archiving 97

Archiving Phishing Passwords Security 97

Security Affairs

OCTOBER 20, 2021

A Cookie Theft malware was employed in phishing attacks against YouTube creators, Google’s Threat Analysis Group (TAG) warns. According to Google’s Threat Analysis Group (TAG) researchers, who spotted the campaign, the attacks were launched by multiple hack-for-hire actors recruited on Russian-speaking forums.

Phishing 135

Phishing Archiving Encryption Authentication 135

Security Affairs

FEBRUARY 5, 2024

The availability of a PoC exploit code could help threat actors to launch attacks against Internet-facing installs. Researchers from Shadowserver observed the exploitation of the flaw CVE-2024-21893 in the wild by multiple threat actors, however, they pointed out that the attacks began hours prior to the publication of the Rapid7 PoC code.

Authentication 110

Authentication Security Access IT 110

Security Affairs

MARCH 29, 2023

Google’s Threat Analysis Group (TAG) discovered several exploit chains targeting Android, iOS, and Chrome to install commercial spyware. Google’s Threat Analysis Group (TAG) shared details about two distinct campaigns which used several zero-day exploits against Android, iOS and Chrome. links sent over SMS to users.

Archiving 96

Archiving Access Risk Security 96

Security Affairs

APRIL 9, 2024

Almost every Chrome exploits observed in the wild between 2021 and 2023 triggered a memory corruption issue in a Chrome renderer process that was exploited for remote code execution (RCE). The V8 Sandbox is designed to prevent memory corruption issues that would impact other areas of memory in the process. ” reads the announcement.

Access 121

Access IT Security Information Security 121

Krebs on Security

JUNE 8, 2021

Among the zero-days are: – CVE-2021-33742 , a remote code execution bug in a Windows HTML component. “The ‘exploit detected’ tag means attackers are actively using them, so for me, it’s the most important piece of information we need to prioritize the patches.”

Security 288

Security Ransomware Phishing Cloud 288

Security Affairs

APRIL 1, 2023

Google TAG shared indicators of compromise (IoCs) for both campaigns. The experts pointed out that both campaigns were limited and highly targeted. The exploits were used to install commercial spyware and malicious apps on targets’ devices.

Cybersecurity 92

Cybersecurity Education Risk Security 92

Security Affairs

JANUARY 12, 2023

Threat actors are actively exploiting a recently patched critical remote code execution (RCE) vulnerability in Control Web Panel (CWP). Ongoing mass exploitation of CVE-2022-44877 (Centos Web Panel 7 Unauthenticated Remote Code Execution). pic.twitter.com/PC8b9frmA9 — Germán Fernández (@1ZRR4H) January 11, 2023.

Security 98

Security IT Information Security 98

Security Affairs

OCTOBER 4, 2023

The IT giant also addressed a buffer overflow issue, tracked as CVE-2023-5217 , in WebRTC that may result in arbitrary code execution. The flaw was discovered by security researcher Clément Lecigne from Google’s Threat Analysis Group (TAG). The company addressed the vulnerability by updating to libvpx 1.13.1.

Security 120

Security IT Information Security 120

Security Affairs

JANUARY 18, 2024

PixieFail issues can be exploited to achieve remote code execution and leakage of sensitive information, and carry out denial-of-service (DoS), and network session hijacking attacks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, Google TAG)

IT 115

IT Information Security Security 115

Security Affairs

NOVEMBER 30, 2023

An attacker can trick a victim into visiting specially crafted web content to potentially execute arbitrary code on the impacted devices. The fact that the issues were discovered by Google TAG suggests they were exploited by a nation-state actor or by a surveillance firm. The company addressed the flaw with improved locking.

Security 126

Security IT Information Security 126

Security Affairs

JANUARY 25, 2022

The investigation started in November after Google TAG published a blogpost about watering-hole attacks targeting macOS users in Hong Kong. Google TAG researchers discovered that threat actors leveraged a zero-day vulnerability in macOS in a watering hole campaign aimed at delivering malware to users in Hong Kong.

Authentication 96

Authentication Security IT Information Security 96

Krebs on Security

MARCH 31, 2019

I undertook the research because Coinhive’s code at the time was found on tens of thousands of hacked Web sites, and Coinhive seemed uninterested in curbing widespread abuse of its platform. Please tag your donation bills properly if they shall be accounted. The official tag is ‘krebsspende.’

Mining 161

Mining Privacy IT 161

Security Affairs

FEBRUARY 25, 2024

Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S.

Military 106

Military Security Ransomware Insurance 106

Security Affairs

AUGUST 28, 2022

Leaked documents details the purchase of an iOS Remote Code Execution zero-day exploit for $8,000,000. Leaked documents online show the purchase (and documentation of) an $8,000,000 iOS Remote Code Execution 0day exploit pic.twitter.com/lhmc8QdfGv — vx-underground (@vxunderground) August 24, 2022.

IT 130

IT Security Information Security 130

Security Affairs

AUGUST 9, 2023

This revealed to us the injected exploit code responsible for remote access to infected machines and redirect-based malvertising scheme control. Within the file, there were seven brackets of PHP tags and each of them contained an obfuscated piece of code within. sortyellowapples[.]com/scripts/get[.]js? com/scripts/get[.]js?

Access 97

Access IT Security Information Security 97

OpenText Information Management

APRIL 19, 2024

VIPER: Well, if IoT was an emoji or an expression, it would be: (1) a cloud with legs, (2) a tornado of devices, or (3) an air-tag tracking anything (keys, dog, purse, avocado). From QR codes to RFID tags to Bluetooth devices, the ability to track and trace physical assets has become much easier. You: What is IoT?

IoT 67

IoT Cloud Authentication Manufacturing 67

Security Affairs

DECEMBER 12, 2021

On Friday, 10, 2021, Chinese security researcher p0rz9 publicly disclosed the PoC exploit code for this issue and revealed that the CVE-2021-44228 can only be exploited if the log4j2.formatMsgNoLookups Query our API for "tags=CVE-2021-44228" for source IP addresses and other IOCs. Tags available to all users and customers now.

Libraries 113

Libraries Digital transformation Education Government 113

Security Affairs

DECEMBER 10, 2021

Experts publicly disclose Proof-of-concept exploits for a critical remote code execution zero-day vulnerability, tracked a CVE-2021-44228 (aka Log4Shell ), in the Apache Log4j Java-based logging library. “An attacker can use this vulnerability to construct a special data request packet, which eventually triggers remote code execution.

Libraries 145

Libraries IT Cloud Data breaches 145

Security Affairs

NOVEMBER 28, 2021

North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported. Google TAG researchers reported that the same group, tracked as Zinc ,” also targeted security researchers in past campaigns.

Security 133

Security Phishing Information Security Communications 133