Aggregator

A vulnerability classified as problematic was found in VirusBlokAda Vba32 Antivirus 3.36.0. This vulnerability affects unknown code in the library Vba32m64.sys. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2024-23439. An attack has to be approached locally. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in VirusBlokAda Vba32 Antivirus 3.36.0. This issue affects some unknown processing in the library Vba32m64.sys of the component IOCTL Handler. The manipulation leads to out-of-bounds read. The identification of this vulnerability is CVE-2024-23440. Local access is required to approach this attack. There is no exploit available.

HackerNews 编译，转载请注明出处： RVTools的官方网站遭到黑客攻击，开始提供被篡改的流行VMware环境报告工具的安装程序。 “Robware.net和RVTools.com目前处于离线状态。我们正在紧急恢复服务，感谢您的耐心等待，”该公司在其网站上发布的声明中表示，“Robware.net和RVTools.com是唯一授权且受支持的RVTools软件下载网站。请勿从任何其他网站或来源搜索或下载所谓的RVTools软件。” 这一事件源于安全研究员Aidan Leon的披露：从该网站下载的受感染安装程序版本被用于侧载一个恶意DLL，该DLL最终被证实是名为Bumblebee的已知恶意软件加载器。目前尚不清楚这个被植入木马的RVTools版本可供下载的时间有多长，也不清楚在该网站下线前有多少用户安装了该版本。在此期间，建议用户验证安装程序的哈希值，并检查用户目录中任何version.dll的执行情况。 此次曝光恰逢另一事件：Procolored打印机提供的官方软件被发现包含一个基于Delphi的后门程序XRed，以及名为SnipVex的剪贴板劫持恶意软件。后者能够将剪贴板中的钱包地址替换为硬编码的攻击者地址。YouTube频道Serial Hobbyism的运营者Cameron Coward最早发现了这些恶意活动细节。 据信至少从2019年就开始活跃的XRed具备收集系统信息、记录键盘输入、通过连接的USB设备传播，以及执行来自攻击者控制服务器的命令（用于截取屏幕截图、枚举文件系统和目录、下载文件、删除系统文件）等功能。G DATA研究员Karsten Hahn对此事件进行了深入调查后指出：“[SnipVex]会搜索剪贴板中类似BTC地址的内容，并将其替换为攻击者的地址，从而使加密货币交易资金被转移到攻击者手中。” 值得注意的是，该恶意软件通过向.EXE文件注入剪贴板劫持功能进行传播，并在文件末尾使用感染标记序列0x0A 0x0B 0x0C以避免重复感染。截至目前，相关钱包地址已收到9.30857859 BTC（约合97.4万美元）。 Procolored公司承认，这些软件包是2024年10月通过USB设备上传至Mega文件托管服务的，恶意软件可能在此过程中被植入。目前仅限F13 Pro、VF13 Pro和V11 Pro产品提供软件下载。Hahn补充说明：“自2024年2月以来，该恶意软件的指挥控制服务器一直处于离线状态。因此XRed在此日期之后无法建立成功的远程连接。但与之配套的剪贴板银行木马SnipVex仍是严重威胁。尽管BTC地址在2024年3月3日之后未再收到交易，文件感染本身仍会对系统造成损害。”       消息来源： thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability was found in phpBB. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument search_results leads to sql injection. This vulnerability is known as CVE-2004-2350. The attack can be launched remotely. Furthermore, there is an exploit available.

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information,...

The post REcollapse: black-box regex fuzzing to bypass validations and discover normalizations in WebApps appeared first on Penetration Testing Tools.

Linkook is an OSINT tool for discovering linked/connected social accounts and associated emails across multiple platforms using a single username. It also supports exporting the gathered relationships in a Neo4j-friendly format for visual analysis. Main Features Search...

The post linkook: An OSINT tool for discovering linked social accounts and associated emails appeared first on Penetration Testing Tools.

英伟达计划 7 月开源物理引擎「牛顿」；苹果考虑将 Apple Intelligence 品牌和 Siri 分离；传英伟达计划投资量子计算独角兽。

近日，中东地区最具专业性的、备受瞩目的GISEC 2025全球网络安全展览会在阿联酋迪拜圆满落下帷幕。本届展

一站式安全运营平台

俄罗斯APT组织最新窃密活动高级免杀样本分析

基于数据流转的全生命周期的数据安全防护。

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

SET GLOBAL validate_password.policy = 'LOW'; MySQL 8提供了 […]

Threat Attack Daily - 19th of May 2025

A vulnerability was found in Oracle Java SE 7u321/8u311/11.0.13/17.01 and classified as critical. Affected by this issue is some unknown functionality of the component Hotspot. The manipulation leads to an unknown weakness. This vulnerability is handled as CVE-2022-21291. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.