Aggregator

#勒索病毒 #Makop #Ransomware Makop勒索病毒攻击

Patchwork APT最新攻击样本与威胁情报分析

匿名者泄露了Black Basta勒索软件团伙的 Matrix 聊天记录，揭示了该团伙的内部分裂、成员信息以及使用的黑客工具。

Key Takeaways Case Summary The intrusion started with the exploitation of CVE-2023-22527, a critical remote code execution vulnerability in Confluence, against a Windows server. The first indication of threat actor activity was the execution of system discovery commands, including net user and whoami. Shortly after, the threat actor attempted to download AnyDesk via curl, but […]

The post Confluence Exploit Leads to LockBit Ransomware appeared first on The DFIR Report.

GreyNoise has observed exploitation attempts targeting two Cisco vulnerabilities, CVE-2023-20198 and CVE-2018-0171. CVE-2023-20198 is being actively exploited by over 110 malicious IPs, primarily from Bulgaria, Brazil, and Singapore, while CVE-2018-0171 has seen exploitation attempts from two malicious IPs traced to Switzerland and the United States. These CVEs were referenced in recent reports on Salt Typhoon, a Chinese state-sponsored threat group, though GreyNoise is not attributing the observed exploitation to Salt Typhoon.

信息网络安全建设国产化代替势在必行。

Fluent Bit 拥有超过 150 亿次下载和每日 1000 万次部署，这些漏洞对全球企业和云生态系统构成严重威胁。

One month into his second term, President Trump's actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort by the world's richest man to wrest control over their networks and data.

这些工具自动化了繁琐的任务，使团队能够扩展复杂的设置，并让工程师掌控DevOps的高速节奏。

A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/pageAE.html. The manipulation of the argument tid leads to cross site scripting. This vulnerability was named CVE-2024-11493. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Navneil Naicer Bootscraper Plugin up to 2.1.0 on WordPress. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2024-52449. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Aaron Robbins Post Ideas Plugin up to 2 on WordPress. Affected is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-52451. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability has been found in Buying Buddy IDX CRM Plugin up to 1.1.12 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2024-52446. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Django CMS Attributes Fields up to 3.x. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-11406. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Bubka 2FAuth up to 5.4.0. This affects an unknown part of the file /api/v1/twofaccounts/preview of the component Endpoint. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-52598. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in petesheppard84 Extensions for Elementor Plugin up to 2.0.37 on WordPress and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-52471. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Weather Atlas Widget Plugin up to 3.0.1 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-52472. The attack may be initiated remotely. There is no exploit available.