yaracroft

CVE-2023-3128 (🚨 CVSS:9.4) - Authentication Bypass in Grafana

This leads to account takeover & authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

( 📸 Picture credits: Netlas⁠.⁠io

grafana.com/security/security-

0
yaracroft

While collecting the evidence in 2023 we (Marco Lux & Pedro Umbelino) recognized the ESXi attack by a random group. We decided it is time to publish our results which cumulated in CVE-2023-29552 ( via John Kristoff )

Interestingly, search engines like @shodan, still missing SLP in their collection, which is a pity.

curesec.com/blog/article/CVE-2

1
yaracroft

Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Hillai Ben-Sasson, a security researcher at Wiz (wiz.io)



wiz.io/blog/azure-active-direc

0
yaracroft

Suspected nation-state involvement by the threat actor LABYRINTH CHOLLIMA. The application is available for Windows, macOS, , & mobile. At time of writing, activity has been observed on both & ( thx: Colin Cowie ( @th3_protoCOL ) & Florian Roth (@cyb3rops) )

falcon.laggar.gcw.crowdstrike.

★ github.com/SigmaHQ/sigma/pull/

★ github.com/Neo23x0/signature-b

0
yaracroft
  • (PoC) CVE-2023-23397

An attacker is able to force a victim to make a connection to its server without manipulation from the user (zero click vulnerability). An attacker exploiting this vulnerability retrieves a NetNTLMv2 digest based on the password of the trapped user through an SMB request

github.com/Trackflaw/CVE-2023-

0
yaracroft

CVE-2023-21036 - Acropalypse Screenshot Hack : Explained

0
yaracroft

🇫🇷 Compromission du site web de la Ville de Chantilly (ville-chantilly.fr)

0
yaracroft

This paper describes a vulnerability in implementations of SHA-3, SHAKE, EdDSA, and other NIST-approved algorithms

eprint.iacr.org/2023/331.pdf

0
yaracroft

🐛 Can you spot the vulnerability? Identifieras-tu la vulnérabilité ?

Credits: ACCEIS (acceis.fr)

0
yaracroft

Cert-IST - bilan 2022

cert-ist.com/pub/files/Cert-IS

0
yaracroft

CVE-2022-39952 PoC

github.com/horizon3ai/CVE-2022

0
yaracroft

This framework describes how a natural or legal person with no fraudulent intent or intention to cause harm can detect and must report existing vulnerabilities in networks and information systems in 🇧🇪 Belgium

ccb.belgium.be/en/news/new-leg

ccb.belgium.be/en/vulnerabilit

0
yaracroft

🇵🇱 Artemis

This tool is built to find website misconfigurations and vulnerabilities on a large scale

cert.pl/en/posts/2023/02/artem

0
yaracroft

CVE-2023-21608 - Adobe Acrobat Reader RCE

github.com/hacksysteam/CVE-202

0
yaracroft

🇮🇳 Diksha, a public education application, exposed the personal information of students and teachers

wired.com/story/diksha-india-e

0
yaracroft

Vulnerabilities in git

cert.europa.eu/static/Security

0
yaracroft

CVE-2023-22809 sudo

synacktiv.com/sites/default/fi

0
yaracroft

🐧 Linux Kernel ksmbd Use-After-Free RCE

zerodayinitiative.com/advisori

0
yaracroft

🚨 CVE-2022-27518

A vulnerability has been discovered in Citrix Gateway and Citrix ADC, listed below, that, if exploited, could allow an unauthenticated Remote attacker to perform arbitrary Code Execution on the appliance

support.citrix.com/article/CTX

1
yaracroft

Backdoor discovered in PLDT Home Fiber routers (pldthome.com) # firmware

0xsp.com/security%20research%2

0
Plus anciens

yaracroft recommande :

informatique

2,96K

threats

2,03K

ransomware

1,24K

france

589

vuln

270

europe

125

tools

124

infosec

61

phishing

48
nanao

Comme le soleil, les machines ne se couchent jamais.

Ressources

Développeurs

Qu’est-ce que Mastodon ?

nanao.cybtex.fr

Davantage…