Aggregator

#科技资讯 论文索引库安娜的档案 (Anna's Archive) 也因为侵犯版权的原因导致订阅频道被 Telegram 封禁。安娜的档案提供 Sci-Hub 和 LibGen 上的各

Here's an overview of the various breaches that have been consolidated into this Have I Been

Java Archive Implant Toolkit Inject malicious payloads into JAR files. Configuration JarPlant supports injection of custom values with the implants. A set of common configuration properties are defined with the template and built-in implants....

The post JarPlant: Java archive implant toolkit appeared first on Penetration Testing Tools.

CNAPPgoat CNAPPgoat is a multi-cloud, vulnerable-by-design environment deployment tool – specifically engineered to facilitate practice arenas for defenders and pentesters. Its main function is to deploy intentionally vulnerable environments across multiple cloud service providers,...

The post cnappgoat: modularly provision vulnerable-by-design components in cloud environments appeared first on Penetration Testing Tools.

随着互联网的全球化发展，越来越多的中国互联网企业和独立开发者都开始将目光投向海外市场。然而，打造一款真正的全球化社交产品，远比想象中要复杂得多。很多人以为做个全球化的社交产品就是把界面翻译成多国语言，

DroneXtract DroneXtract is a comprehensive digital forensics suite for DJI drones made with Golang. It can be used to analyze drone sensor values and telemetry data, visualize drone flight maps, audit for criminal activity,...

The post DroneXtract: A digital forensics suite for DJI drones appeared first on Penetration Testing Tools.

A vulnerability classified as problematic was found in RemotelyAnywhere 8.0.668. Affected by this vulnerability is an unknown functionality of the file remotelyanywhere.exe. The manipulation leads to improper input validation. This vulnerability is known as CVE-2008-1278. The attack can be launched remotely. Furthermore, there is an exploit available.

#软件资讯 Microsoft 365 系列应用将在 10 月份停止支持 Windows 10 系统，因为到 10 月份 Windows 10 要被结束支持不再提供安全更新。届时 Mi

HackerNews 编译，转载请注明出处： 网络安全研究人员发出警告，一项新的恶意广告活动正针对通过谷歌广告进行宣传的个人和企业，试图通过谷歌上的欺诈广告进行网络钓鱼，窃取他们的登录凭证。 Malwarebytes威胁情报高级总监Jérôme Segura在一份与The Hacker News共享的报告中指出：“该诈骗方案通过冒充谷歌广告，诱骗受害者访问假冒的登录页面，从而窃取尽可能多的广告主账户。” 据推测，该活动的最终目的是利用窃取的凭证继续扩大诈骗活动，同时还在地下论坛上将这些凭证出售给其他犯罪分子。根据Reddit、Bluesky和谷歌官方支持论坛上的帖子，这一威胁自2024年11月中旬以来便已开始活跃。 这一系列活动与利用窃取器恶意软件窃取与Facebook广告和商业账户相关的数据，以劫持这些账户并用于推送进一步传播恶意软件的恶意广告活动的行为极为相似。 新发现的诈骗活动专门针对在谷歌搜索引擎上搜索谷歌广告的用户，向他们展示虚假的谷歌广告，点击后会将用户重定向到托管在Google Sites上的欺诈网站。 这些网站作为着陆页，引导访问者访问外部钓鱼网站，这些网站通过WebSocket捕获他们的登录凭证和二次验证码（2FA），并将其传输到攻击者控制的远程服务器上。 Segura表示：“这些假冒的谷歌广告来自不同地点和行业的个人和企业（包括一家地区机场）。其中一些账户已有数百条其他合法广告在运行。” 该诈骗活动的一个巧妙之处在于，它利用了谷歌广告不要求最终URL（用户点击广告后到达的网页）与展示URL必须相同（只要域名匹配）的规则。 这使得威胁分子可以在sites.google[.]com上托管他们的中间着陆页，同时保持展示URL为ads.google[.]com。此外，他们的作案手法还包括使用指纹技术、反爬虫流量检测、受验证码启发的诱饵、伪装和混淆等技术来隐藏钓鱼基础设施。 Malwarebytes表示，窃取的凭证随后被用于登录受害者的谷歌广告账户，添加新的管理员，并利用他们的预算发布虚假的谷歌广告。 换句话说，威胁分子正在接管谷歌广告账户来推送自己的广告，以便将新受害者添加到不断增长的被黑客攻击的账户池中，这些账户被用于进一步延续诈骗活动。 Segura说：“这些活动背后似乎有几个个人或团体。值得注意的是，他们中的大多数是葡萄牙语使用者，可能位于巴西。钓鱼基础设施依赖于使用.pt顶级域名（TLD）的中间域名，这表明与葡萄牙有关。” “这种恶意广告活动并不违反谷歌的广告规则。威胁分子被允许在广告中显示欺诈性URL，使其与合法网站难以区分。谷歌尚未表明它采取了决定性措施来冻结这些账户，直到其安全性得到恢复。” 这一披露之际，Trend Micro透露，攻击者正在利用YouTube和SoundCloud等平台分发指向假冒安装程序的链接，这些安装程序针对的是流行软件的盗版版本，最终会导致部署各种恶意软件家族，如Amadey、Lumma Stealer、Mars Stealer、Penguish、PrivateLoader和Vidar Stealer。 该公司表示：“威胁分子经常使用Mediafire和Mega.nz等可信赖的文件托管服务来隐藏恶意软件的来源，并使检测和清除变得更加困难。许多恶意下载都受到密码保护并进行了编码，这在沙箱等安全环境中增加了分析的复杂性，并使恶意软件能够逃避早期检测。”   消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

error code: 521

A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. This vulnerability was named CVE-2024-3006. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The identification of this vulnerability is CVE-2024-3007. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. This vulnerability is traded as CVE-2024-3008. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. This vulnerability is known as CVE-2024-3009. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. This vulnerability is handled as CVE-2024-3010. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-3011. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. This vulnerability was named CVE-2024-3012. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-3143. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2024-3144. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.