Plus récents
yaracroft

SAML is insecure by design : SAML uses signatures based on computed values. The practice is inherently insecure and thus SAML as a design is insecure

joonas.fi/2021/08/saml-is-inse

0
yaracroft

Golden SAML

secureworks.com/blog/going-for

0
yaracroft

ProxyShell PoC Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)

github.com/ktecv2000/ProxyShel

0
yaracroft

In this research, our goal is to read « LSASS.exe » memory from userland. We experimented against Total Security (KTS), one of the top security products currently.

blog.vincss.net/2021/08/ex007-

0
yaracroft

pyWhisker is a tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object.

github.com/ShutdownRepo/pywhis

0
yaracroft

Limelighter is a tool for generating fake code signing certificates or signing real ones

github.com/Tylous/Limelighter

0
yaracroft

ADSI is a set of interfaces allowing administrators to query information on an *Active Directory environment

grimmie.net/tools-techniques-a

0
yaracroft

ProxyLogon is just the tip of the Iceberg : A new attack surface on Exchange Server

i.blackhat.com/USA21/Wednesday

0
yaracroft

: Pentesting &

0
yaracroft

(CVE-2020-29015) An OS command injection vulnerability in FortiWeb's management interface (version 6.3.11 and prior) can allow a remote, authenticated attacker to execute arbitrary commands on the system, via the SAML server configuration page

rapid7.com/blog/post/2021/08/1

0
yaracroft

(CVE-2021-28372) Critical Vulnerability That Affects Millions of internet-of-things () that use the ThroughTek « Kalay » network - one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors

fireeye.com/blog/threat-resear

0
yaracroft

(CVE-2021-21832) Memory corruption vulnerability in Daemon Tools Pro can cause memory corruption in the application if the user opens an adversary-created ISO file that causes an integer overflow. This vulnerability exists in the way the application parses ISOs.

blog.talosintelligence.com/202

0
yaracroft

Operation Infektion

go.recordedfuture.com/hubfs/re

0
yaracroft

Multiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Chain : At least 65 vendors affected by severe vulnerabilities that enable unauthenticated attackers to fully compromise the target device and execute arbitrary code with the highest level of privilege. chipsets are found in many embedded in the IoT space. RTL8xxx SoCs – which provide capabilities – are very common.

  • CVE-2021-35392 ( Simple Config’ stack buffer overflow via UPnP)
  • CVE-2021-35393 (WiFi Simple Config’ heap buffer overflow via SSDP)
  • CVE-2021-35394 (MP Daemon diagnostic tool command injection)
  • CVE-2021-35395 (management web interface multiple vulnerabilities

iot-inspector.com/blog/advisor

0
yaracroft

Ce dimanche 15 août 2021, le centre de de Saint-Céré () a été victime d'un acte de vandalisme. Les faits ont été constatés lundi 16 août 2021 au matin par les responsables de cet espace dédiés aux injections contre la -19. Outre les dégradations, le matériel permettant la gestion de cet acte médical et la délivrance du pass sanitaire a été dérobé

ladepeche.fr/2021/08/17/lot-il

0
yaracroft

Volodymyr Diachenko, security researcher at Comparitech (comparitech.com) has revealed the discovery of a federal terrorist watchlist that includes 1.9 million records. The watchlist came from the Terrorist Screening Center (TSC), a multi-agency group administered by the FBI. The TSC maintains the country's no-fly list, which is a subset of the larger watchlist. The exposed server was indexed by search engines Censys (censys.io) and ZoomEye (zoomeye.org)

threatpost.com/terrorist-watch

0
yaracroft

's Tokio Marine (tokiomarinehd.com), which has a U.S. division and offers a product, is the latest insurer to be victimized by

cyberscoop.com/tokio-marine-ry

0
yaracroft

Utilities to extract secrets from 1Password

posts.specterops.io/1password-

0
yaracroft

Suite au piratage du médecin responsable du centre de d'Arcachon () , des malfaiteurs ont pu se connecter avec ses identifiants sur le site de l'Agence Numérique de la Santé (esante.gouv.fr) et imprimer 55 certificats de vaccination

france3-regions.francetvinfo.f

0
yaracroft

Pine64 PineNote (e-ink device) Specifications:
60 FPS e-ink panel
191.1 x 232.5 x 7.4mm
Total Weight: 438g
OS: Manjaro
10.3″ 1404 x 1872 Resolution (Pixels)
227 DPI
16 levels of Grayscale
Touchscreen
EMR Stylus Pen with Wacom technology
Front light (FL)
36 level cold and warm light
CPU = RK3566 1.8GHz 64-bit Quad-Core A55

pine64.org/2021/08/15/introduc

0
Plus anciens

yaracroft recommande :

informatique

2,96K

threats

2,03K

ransomware

1,24K

france

589

vuln

270

europe

125

tools

124

infosec

61

phishing

48
nanao

Comme le soleil, les machines ne se couchent jamais.

Ressources

Développeurs

Qu’est-ce que Mastodon ?

nanao.cybtex.fr

Davantage…