Aggregator

error code: 521

HackerNews 编译，转载请注明出处：   网络安全研究人员揭露了一项新活动，该活动针对运行基于PHP应用的Web服务器，以在印度尼西亚推广赌博平台。 Imperva公司研究员Daniel Johnston在分析中指出：“过去两个月，我们观察到大量来自基于Python的机器人的攻击，这表明有一股势力在协同利用成千上万的Web应用。这些攻击似乎与赌博相关网站的泛滥有关，可能是对政府加强审查的回应。” 这家隶属于泰雷兹集团的公司表示，他们检测到数百万条来自Python客户端的请求，该客户端包含安装GSocket（又称Global Socket）的命令，这是一种开源工具，可用于在两个机器之间建立通信通道，不受网络边界的限制。 值得注意的是，近几个月来，GSocket已被用于多起加密货币劫持活动，甚至还被利用来插入恶意JavaScript代码，以窃取网站上的支付信息。 攻击链特别涉及利用已遭入侵服务器上预先存在的Web shell来部署GSocket。大多数攻击都瞄准了运行着一种名为Moodle的流行学习管理系统（LMS）的服务器。 攻击的一个显著特点是，在bashrc和crontab系统文件中添加了内容，以确保即使删除了Web shell，GSocket也能持续运行。 经确认，GSocket为这些目标服务器提供的访问权限被用作武器，以交付包含指向在线赌博服务（特别是针对印度尼西亚用户）的HTML内容的PHP文件。 Johnston说：“每个PHP文件的顶部都有PHP代码，只允许搜索机器人访问页面，而普通访问者则会被重定向到另一个域名。其背后的目的是瞄准搜索已知赌博服务的用户，然后将他们重定向到另一个域名。” Imperva表示，这些重定向指向了已知的印度尼西亚赌博网站“pktoto[.]cc”。 与此同时，c/side披露了一项广泛的恶意软件活动，该活动已针对全球超过5000个网站，创建未经授权的管理员账户，从远程服务器安装恶意插件，并将凭据数据回传至该服务器。 目前尚不清楚这些网站上部署JavaScript恶意软件的确切初始访问向量。该恶意软件被命名为WP3.XYZ，以与其用于获取插件和泄露数据的服务器域名（“wp3[.]xyz”）相关联。 为防范此类攻击，建议WordPress网站所有者保持插件更新，使用防火墙阻止恶意域名，扫描并删除可疑的管理员账户或插件。 消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability classified as critical was found in Sun Solaris. This vulnerability affects unknown code. The manipulation leads to denial of service. This vulnerability was named CVE-2008-5010. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

error code: 521

HackerNews 编译，转载请注明出处： 网络安全研究人员披露了Planet Technology公司的WGS-804HPT工业交换机存在的三项安全漏洞，攻击者可利用这些漏洞在易受攻击的设备上实现未经认证的远程代码执行。 Claroty公司的Tomer Goldschmidt在周四的报告中表示：“这些交换机广泛用于建筑和家居自动化系统中的各种网络应用。攻击者如果能够远程控制这些设备中的任意一个，就可以利用它们进一步攻击内部网络中的其他设备，并进行横向移动。” 这家运营技术安全公司对使用QEMU框架的交换机固件进行了深入分析，发现漏洞源于提供网络服务的dispatcher.cgi接口。漏洞列表如下： CVE-2024-52558（CVSS评分：5.3）——整数下溢漏洞，允许未经认证的攻击者发送格式错误的HTTP请求，导致设备崩溃。 CVE-2024-52320（CVSS评分：9.8）——操作系统命令注入漏洞，允许未经认证的攻击者通过恶意HTTP请求发送命令，实现远程代码执行。 CVE-2024-48871（CVSS评分：9.8）——基于栈的缓冲区溢出漏洞，允许未经认证的攻击者发送恶意HTTP请求，实现远程代码执行。 成功利用这些漏洞后，攻击者可以通过在HTTP请求中嵌入shellcode来劫持执行流程，并获得执行操作系统命令的能力。 在负责披露漏洞后，这家中国台湾公司已于2024年11月15日发布了版本1.305b241111的补丁，以修复这些漏洞。   消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

go-secdump Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without...

The post go-secdump: remotely dump secrets from the Windows registry appeared first on Penetration Testing Tools.

iMonitor iMonitor (Endpoint Behavior Analysis System – Then Open Source Procmon) is an endpoint behavior monitoring and analysis software based on iMonitorSDK. Provides monitoring of system behaviors such as processes, files, registry, and networks. Support...

The post iMonitor: Endpoint Behavior Analysis System appeared first on Penetration Testing Tools.

A vulnerability classified as problematic has been found in Apple Mac OS X up to 10.4.5. This affects an unknown part of the component Security Policy Handler. The manipulation leads to basic cross site scripting. This vulnerability is uniquely identified as CVE-2006-0396. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Apple Mac OS X up to 10.4.5. This vulnerability affects unknown code of the component Mail. The manipulation leads to memory corruption. This vulnerability was named CVE-2006-0396. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Philippe Jounin Tftpd32 2.81 and classified as problematic. This issue affects some unknown processing. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2006-0328. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in RealNetworks RealPlayer 10.0.6/10.5. It has been classified as very critical. Affected is an unknown function in the library swfformat.dll. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2006-0323. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Mozilla Firefox up to 1.5. It has been rated as critical. This issue affects the function xuldocument.persist. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2006-0296. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Mozilla SeaMonkey 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to memory corruption. This vulnerability was named CVE-2006-0295. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in qemu up to 0.11.0 and classified as problematic. This issue affects some unknown processing. The manipulation leads to improper authentication. The identification of this vulnerability is CVE-2011-0011. The attack needs to be done within the local network. There is no exploit available. It is recommended to add further authentication.

A vulnerability has been found in Microsoft Windows and classified as very critical. Affected by this vulnerability is an unknown functionality of the component Wordpad. The manipulation as part of Word 97 Document leads to code injection. This vulnerability is known as CVE-2011-0028. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Microsoft Windows. This issue affects some unknown processing of the component Remote Desktop Client. The manipulation leads to untrusted search path. The identification of this vulnerability is CVE-2011-0029. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft Windows Server 2003/XP. It has been rated as critical. Affected by this issue is some unknown functionality of the component CSRSS Logoff. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2011-0030. The attack can only be done within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

Currently trending CVE - hypeScore: 1

A vulnerability was found in Microsoft Windows. It has been classified as problematic. Affected is an unknown function of the component WINS. The manipulation leads to denial of service. This vulnerability is traded as CVE-1999-0294. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

阅读： 14一、漏洞概述近日，绿盟科技监测到Rsync发布安全公告，修复了Rsync中的缓冲区溢出与信息泄露漏洞（CVE-2024-12084/CVE-2024-