SOLDIERX.COM Nobody Can Stop Information Insemination

On Second Thought...

Re: BugTraq Shutdown

Re: [SECURITY] [DSA 4628-1] php7.0 security update

BugTraq Shutdown

News, Infocus, Columns, Vulnerabilities, Bugtraq ...

Posted by malvuln on Aug 06

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/f240c16af2189ea9c94f317281ce7e59.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Zaratustra
Vulnerability: Unauthenticated Remote File Write (Remote Code Exec)
Description: Zaratustra malware listens on TCP port 660. Third-party
attackers who can reach infected systems can use a socket program to write
binary...

Posted by malvuln on Aug 06

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/cedc886b593f013133df39bb6b43a762.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Zdemon.126
Vulnerability: Unauthenticated Remote Command Execution
Description: Zdemon malware listens on TCP ports 31556, 6051. Third-party
attackers who can reach infected systems can execute commands made
available by the...

Posted by malvuln on Aug 06

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/d12f38e959d70af76fd263aa1933033c.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Zdemon.10
Vulnerability: Unauthenticated Remote Command Execution
Description: Zdemon malware listens on TCP ports 31556, 6051. Third-party
attackers who can reach infected systems can execute commands made
available by the...

Posted by malvuln on Aug 06

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/07122dd3b069bbbb445e060c1249d5a2.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Small.fp
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on random TCP ports like 2904, 1200 etc.
Third-party attackers who can connect to the infected system can relay
requests from the original...

Posted by malvuln on Aug 06

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/da60b92742abff72930879fa8560b3c3.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Constructor.Win32.SS.11.c
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on TCP port 9035. Third-party attackers
who can connect to the infected system can relay requests from the original
connection to the destination...

Posted by merion44 via Fulldisclosure on Aug 06

app: connect-app (cdu) (version: 3.8)

cross-site scripting in the registration form name variables. Remote attackers can inject js payloads as name variables
to exploit the frontend in the profile view and potentially execute in the backend via the preview. Uncertainty in
validating object names in outbound emails, causing the context to be validated insecurely. This allows reflected
execution in the message body of the email where the name...

Posted by Adrien JOLIBERT on Aug 06

Quite an old trick becoming popular.
So yep, the stuff is hosted on one of the google services in private mode; redirections gives you a valid token to
access.

Posted by malvuln on Aug 03

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/c98e23742807f3cb5a095f34e0eb0e52.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.WinShell.40
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 5277, third-party attackers
who can reach the system can execute OS commands further compromising the
already infected...

Posted by Marcin Kozlowski on Aug 03

Hi list,

Posting here for transparency reasons. A 16k stars project, used in, I can
imagine game engines, UI, Android/iOS/embedded. Used in another 30k stars
project and 11k from even Google (also possibly not fixed). OpenCV 55k
stars seems to be also affected (new branch only). Attack vector through
malicious font. Buy me a beer if you will get bounty on it and initial
fuzzing person https://github.com/nothings/stb/issues/618

Should this have...

Posted by Nick Boyce on Aug 03

I notice that among the spam in my Gmail spam folder, there are a
number of "address-check" type messages (i.e. that just seek
confirmation my address exists), which attempt to get their response
by performing a scripted redirect via a web property belonging to
Google ...... and I tend to think "Huh? ... Surely Google wouldn't let
that happen ... is this redirect something that by some chance they
don't know about...

Posted by Moses Frost via Dailydave on Jul 26

I am always in shock when people cannot see the forests from the tree's even when talking to peers. First things first,
Azure AD and many IdP's are not impervious to attack. Through Oauth2 and other privilege abuse angles in the IdP
itself, backdooring systems are (and will continue to be) a thing. For those on defense, I hope you are checking on
those MS Graph enabled Service Principals while I am waving at the other end (hello)....

Posted by François Zöfel via Dailydave on Jul 26

Speaking for a heavily regulated EU business here: a US cloud based solution will most probably not fit our needs. Both
GDPR and rules about not being dependent on 3rd party businesses to conduct our own mean we’re stuck with an on-prem AD.

I’m very interested to hear about any potential alternative.

François

Le dim., juil. 25, 2021 à 07:50, Peter Bance via Dailydave <dailydave () lists aitelfoundation org> a écrit :

Dailydave...

Posted by Peter Bance via Dailydave on Jul 25

Funnily enough, I’ve just decommissioned our last Domain Controller - as you rightly say, AD is just too much pain/risk
to keep in place. Azure AD for us - still not 100% ideal, but rapidly improving, and transfers a lot of the
infrastructure/config pain to Microsoft themselves.

Obviously admins can still make horrible mistakes, but that’s easier to monitor than all config across an on-prem
forest, and it’s far simpler to limit (or even...

Posted by Dave Aitel via Dailydave on Jul 24

So I definitely have a different mental history of active directory than
most people, and recently I was doing a Glasshouse podcast with Pablo Breuer
<https://www.linkedin.com/in/pablobreuer/> and here
<https://youtu.be/Z0d6qNLevUY?t=2714> he says basically the same thing
everyone says, which is that it's impossible to move off of technology even
when that technology has a history of severe flaws, or a design flaw that
means it...

Posted by Timesportsall on Jan 16

------------------------------------------------------------------------
-
Debian Security Advisory DSA-4628-1 security (at) debian (dot) org [email concealed]
https://www.debian.org/security/ Moritz Muehlenhoff
February 18, 2020 https://www.debian.org/security/faq
------------------------------------------------------------------------
-

Package : php7.0
CVE ID : CVE-2019-11045 CVE-2019-11046 CVE-2019-11047
CVE-2019-11050 CVE-2020-7059...