❗❗ Threat actors never sleep! Beware of the clever phishing attacks they're leveraging from the CrowdStrike outages!
Threat Intelligence Evangelism Director, CW Cyber Research Unit, OSCP, MAD ATT&CK CTI
Threat actors are making use of the Crowdstrike outages with some clever phishing tactics. The example below is a domain created today being used in an active phishing campaign: https://lnkd.in/gVmsf8HS
Threat Intelligence Evangelism Director, CW Cyber Research Unit, OSCP, MAD ATT&CK CTI
Threat actors are making use of the Crowdstrike outages with some clever phishing tactics. The example below is a domain created today being used in an active phishing campaign: https://lnkd.in/gVmsf8HS
🔴 Two zero-day vulnerabilities related to Ivanti VPN (previously known as PulseSecure) have been identified and are being exploited in the wild 🔴 We are actively working with our customers to mitigate this risk. The vulnerabilities, with CVSS scores of 8.2 and 9.1, make it trivial for attackers to take over the machine upon which the software is running, acting as an entry point for Ransomware deployment or Data Exfiltration. ➡ Mitigation advisory from Ivanti: https://lnkd.in/e_FFqNQm ➡ More details can be found here on the Ivanti forum: https://lnkd.in/g58pBX_v ➡ And this blog: https://lnkd.in/gJwgWdbF
Tracks vulnerable to reflected cross&site scriptingTracks, a Getting Things D...Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaSc... Tracks, vulnerable, reflected, cross-site, scriptingTracks, Getting, Things, D...
Senior Security Analyst at Accenture | C|EH | Qualys Certified Specialist | AZ-900 | TryHackMe Top 3% | Ex- TCSer
🚨🔒 Successfully Identified and Thwarted a Potential XSS Attack! 🔒🚨 In a recent incident investigation, I meticulously analyzed system's logs and detected a suspicious activity involving JavaScript queries masquerading as parameter values. Through detailed scrutiny of source and destination IP addresses, I observed multiple attempts at a potential XSS attack. Fortunately, due to robust security measures, all attempts failed, with a response size of 0 and a status of 302 - a clear indication of redirection and unsuccessful infiltration. To ensure no further compromise, I thoroughly combed through all logs associated with the malicious IP, affirming that no other devices were communicated with, mitigating any risk of contamination. As a result, no additional action is required to fortify defenses. For a detailed breakdown of the incident report, dive into the investigation here: https://lnkd.in/guPi8uEQ #CyberSecurity #XSS #IncidentResponse #SecurityAnalysis #letsdefend #socanalyst
Critical Remote Code Execution Vulnerability Addressed in GiveWP PluginThe vulnerability, identified as CVE-2024-5932, arises from inadequate validation of user-provided serialized data, allowing attackers to inject harmful PHP objects through the give_title parameter.Critical Remote Code Execution Vulnerability Addressed in GiveWP Plugin
I am happy to share my first writeup of Devvortex room on Hack the Box. Feel free to check it and tell me do you like it or not 😊 #hackthebox #writeup #CTF #cybersecurity
SimpleMachines SMF Delete User index.php resource injectionA vulnerability, w...A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the ... SimpleMachines, SMF, Delete, User, index.php, resource, injectionA, vulnerability, w...
ISC2 Certified in Cybersecurity | MSc Computer Science | MEng Mechanical Engineering | Based in Manchester
I've completed the TryHackMe room on cross-site scripting. It provides examples of different payloads, describes reflected, stored, DOM-based, and blind XSS attacks, and then provides two example websites upon which to execute the techniques. The first runs you through how different obstacles some web developers will use can be overcome to execute an alert() script. The latter obtains the cookies of a simulated support ticket staff by setting up a listener with Netcat and then executing a fetch() using our machine's IP and listening port when the support staff "opens" the ticket.
SimpleMachines SMF User Alert Read Status index.php resource injectionA vulne...A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=s... SimpleMachines, SMF, User, Alert, Read, Status, index.php, resource, injectionA, vulne...
SourceCodester Simple Forum Website Signup Page registration.php cross site s...A vulnerability, which was classified as problematic, was found in SourceCodester Simple Forum Website 1.0. This affects an unknown part of the file /registration.php of the component Signup Page. ...SourceCodester Simple Forum Website Signup Page registration.php cross site s...
