Blahalla

Last Week in Security (LWiS) - 2025-08-18

blog.badsectorlabs.com · 11 months ago

DEF CON releases, PDQ SmartDeploy creds ( @unsignedsh0rt ), FortiSIEM root command injection ( @SinSinology ), a cat themed loader ( @vxunderground ), fine-tune LLMs for offsec ( @kyleavery ), juicing NTDS.DIT ( @MGrafnetter ), and more!

SVD-2025-0801: Third-Party Package Updates in Splunk AppDynamics On-Premises Enterprise Console - August 2025

advisory.splunk.com · 1 year, 7 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics On-Premises Enterprise Console version 25.4.0 and higher.

SVD-2025-0802: Third-Party Package Updates in Splunk AppDynamics Cluster Agent - August 2025

advisory.splunk.com · 1 year, 7 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Cluster Agent version 25.6.0, and higher.

Last Week in Security (LWiS) - 2025-08-04

blog.badsectorlabs.com · 1 year, 8 days ago

AEM RCE ( @infosecau ), Intune cert abuse ( @dirkjan ), Entra tradecraft ( @hotnops ), LLMs for R&D ( @kyleavery ), File System API research ( @Print3M ), and more!

Legal aid cyber-attack has pushed sector towards collapse, say lawyers

www.theguardian.com · 1 year, 9 days ago

Barristers report going unpaid and cases being turned away amid fears firms will desert legal aid work altogether Lawyers have warned that a cyber-attack on the Legal Aid Agency has pushed the sector into chaos, with barristers going unpaid, cases being turned away and fears a growing number of firms could desert legal aid work altogether. In May, the legal aid agency announced that the personal data of hundreds of thousands of legal aid applicants in England and Wales dating back to 2010 had been accessed and downloaded in a significant cyber-attack. Continue reading

SVD-2025-0713: Third-Party Package Updates in Splunk User Behavior Analytics (UBA) - July 2025

advisory.splunk.com · 1 year, 14 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk User Behavior Analytics (UBA) version 5.4.3

SVD-2025-0715: Third-Party Package Updates in Enterprise Security 8.1.0 - July 2025

advisory.splunk.com · 1 year, 14 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Enterprise Security versions 8.1.0 and higher.

SVD-2025-0714: Third-Party Package Updates in Enterprise Security 7.3.4 - July 2025

advisory.splunk.com · 1 year, 14 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Enterprise Security versions 7.3.4, and higher.

Last Week in Security (LWiS) - 2025-07-28

blog.badsectorlabs.com · 1 year, 15 days ago

VMware Tools LPE ( @justbronzebee ), Adaptix C2 0.7 ( @hackerralf ), Ludus MCP ( @Mastadon ), SOAP(y) ( @logangoins ), and more!

Last Week in Security (LWiS) - 2025-07-21

blog.badsectorlabs.com · 1 year, 22 days ago

PIC agents ( @RastaMouse ), ToolShell, Async BOFs ( @Cneelis ), SCCM MP relays ( @unsignedsh0rt ), RAITrigger ( @ShitSecure ), and more!

How to catch GitHub Actions workflow injections before attackers do

github.blog · 1 year, 27 days ago

Strengthen your repositories against actions workflow injections, one of the most common vulnerabilities.

Last Week in Security (LWiS) - 2025-07-14

blog.badsectorlabs.com · 1 year, 29 days ago

LudusHound ( @bagelByt3s ), SpeechRuntimeMove ( @ShitSecure ), Havoc Pro ( @C5pider ), FortiWeb RCE ( @SinSinology ), SailPoint IQService RCE ( @NetSPI ), Altiris RCE ( @lefterispan ), WAF bypass ( @nyxgeek ), and more!

‘Hacking is assumed now’: experts raise the alarm about added risk of surveillance cameras in childcare centres

www.theguardian.com · 1 year, 1 month ago

As governments consider mandatory CCTV in early education, one big provider with cameras already installed is yet to formalise guidelines for how the footage will be stored and used Get our breaking news email, free app or daily news podcast In the wake of horrifying reports last week alleging that eight children had been sexually abused by a worker in a Melbourne childcare centre, politicians and providers have scrambled to offer a response. One option emerged from the fray as something concrete and immediate: the installation of CCTV cameras in childcare centres. Sign up for Guardian Australia’s breaking news email Continue reading

Louis Vuitton says UK customer data stolen in cyber-attack

www.theguardian.com · 1 year, 1 month ago

Lead brand of French luxury group LVMH reassures customers financial data such as bank details were not taken Louis Vuitton has said the data of some UK customers has been stolen, as it became the latest retailer targeted by cyber hackers. The retailer, the leading brand of the French luxury group LVMH, said an unauthorised third party had accessed its UK operation’s systems and obtained information such as names, contact details and purchase history. Continue reading

Modeling CORS frameworks with CodeQL to find security vulnerabilities

github.blog · 1 year, 1 month ago

Discover how to increase the coverage of your CodeQL CORS security by modeling developer headers and frameworks.

Last Week in Security (LWiS) - 2025-07-07

blog.badsectorlabs.com · 1 year, 1 month ago

Lenovo Applocker bypass ( @Oddvarmoe ), Citrix Bleed 2 ( @SinSinology, @inkmoro, Aliz Hammond), A+ adversary simulation ( @quarkslab ), DreamWalkers loader ( @max2cbx ), SigStrike ( @rushter ), and more!

SVD-2025-0703: Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious payload through the User Interface - Views configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

SVD-2025-0709: Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and you configure the Splunk Enterprise SHCConfig log channel at the DEBUG logging level in the clustered deployment. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See Define roles on the Splunk platform with capabilities, Deploy a search head cluster, Deploy secure passwords across multiple servers and Set a security key for the search head cluster for more information.

SVD-2025-0706: Missing Access Control of Saved Searches in the Splunk Archiver app

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the “admin” or “power” Splunk roles could turn off the scheduled search Bucket Copy Trigger within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.

SVD-2025-0705: Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service (DoS). The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will. See How rolling restart works for more information.

SVD-2025-0711: Third-Party Package Updates in Splunk Universal Forwarder - July 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, and higher.

SVD-2025-0708: Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the “admin” or “power” Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See Define alert suppression groups to throttle sets of similar alerts.

SVD-2025-0704: Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC. The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.

SVD-2025-0710: Third-Party Package Updates in Splunk Enterprise - July 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, and higher.

SVD-2025-0712: Third-Party Package Updates in Splunk SOAR - July 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk SOAR 6.4.1.

SVD-2025-0702: Remote Command Execution through Scripted Input Files in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability editscripted and listinputs capability, could perform a remote command execution due to improper user input sanitization on the scripted input files. See Define roles on the Splunk platform with capabilities and Setting up a scripted input for more information.

SVD-2025-0701: Third-Party Package Updates in Splunk DB Connect - July 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk DB Connect versions 4.0.0 and 3.18.4 or higher.

SVD-2025-0707: Improper Access Control in System Source Types Configuration in Splunk Enterprise

advisory.splunk.com · 1 year, 1 month ago

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the “admin” or “power” Splunk roles could create or overwrite system source type configurations by sending a specially-crafted payload to the /servicesNS/nobody/search/admin/sourcetypes/ REST endpoint on the Splunk management port.

CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre

github.blog · 1 year, 1 month ago

DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.

Understand your software’s supply chain with GitHub’s dependency graph

github.blog · 1 year, 1 month ago

The GitHub dependency graph maps every direct and transitive dependency in your project, so you can identify risks, prioritize fixes, and keep your code secure.

Last Week in Security (LWiS) - 2025-06-30

blog.badsectorlabs.com · 1 year, 1 month ago

Linux sleep obfs ( @k0zmer ), sudo vuln ( @0xm1rch ), self-xss trick ( @slonser ), primitive injection ( @trickster012 ), Sitecore RCE ( @chudyPB ), and more!

GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them

github.blog · 1 year, 1 month ago

Use these insights to automate software security (where possible) to keep your projects safe.

SVD-2025-0607: Third-Party Package Updates in Splunk/Splunk Docker - June 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in the “splunk/splunk“ Docker image with image tags “9.4.2“, “9.3.4“, “9.2.6“, “9.1.9“, and “latest“. Docker images with tags “9.4“, “9.3“, “9.2“, and “9.1“ also include these fixes.

SVD-2025-0609: Third-Party Package Updates in Splunk Operator for Kubernetes - June 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Operator for Kubernetes version 2.8.0 and higher.

SVD-2025-0608: Third-Party Package Updates in Splunk/UniversalForwarder Docker - June 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in the “splunk/universalforwarder“ Docker image with image tags “9.4.2“, “9.3.4“, “9.2.6“, “9.1.9“, and “latest“. Docker images with tags “9.1“, “9.2“, “9.3“, and “9.4“ also include these fixes.

SVD-2025-0610: Third-Party Package Updates in Splunk AppDynamics Smart Agent - June 2025

advisory.splunk.com · 1 year, 1 month ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Smart Agent version 25.5.1, and higher.

UK ‘woefully’ unprepared for Chinese and Russian undersea cable sabotage, says report

www.theguardian.com · 1 year, 1 month ago

CSRI finds China and Russia may be coordinating ‘grey zone’ tactics against vulnerable western infrastructure China and Russia are stepping up sabotage operations targeting undersea cables and the UK is unprepared to meet the mounting threat, according to new analysis. A report by the China Strategic Risks Institute (CSRI) analysed 12 incidents in which national authorities had investigated alleged undersea cable sabotage between January 2021 and April 2025. Of the 10 cases in which a suspect vessel was identified, eight were directly linked to China or Russia through flag-state registration or company ownership. Continue reading

European journalists targeted with Paragon Solutions spyware, say researchers

www.theguardian.com · 1 year, 2 months ago

Citizen Lab says it found ‘digital fingerprints’ of military-grade spyware that Italy has admitted using against activists The hacking mystery roiling the Italian prime minister Giorgia Meloni’s rightwing government is deepening after researchers said they had found new evidence that two more journalists were targeted using the same military-grade spyware that Italy has admitted to using against activists. A parliamentary committee overseeing intelligence confirmed earlier this month that Italy had used mercenary spyware made by Israel-based Paragon Solutions against two Italian activists. Continue reading

SVD-2025-0606: Third-Party Package Updates in Splunk Machine Learning Toolkit - June 2025

advisory.splunk.com · 1 year, 2 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Machine Learning Toolkit (MLTK) version 5.6.0 and higher.

SVD-2025-0605: Third-Party Package Updates in Python for Scientific Computing - June 2025

advisory.splunk.com · 1 year, 2 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Python for Scientific Computing versions 4.2.3 or 3.2.3 and higher.

Last Week in Security (LWiS) - 2025-06-09

blog.badsectorlabs.com · 1 year, 2 months ago

Windows self-delete on 24H2 ( @TKYNSEC ), DNS rebinding ( @yarlob ), VSCode backdoor ( @d1rkmtr ), leak Google users' 📞 ( @brutecat ), Entra sync dumping ( @hotnops ), Delegations ( @podalirius ), Chrome abuse for screenshots, mic, and camera access ( @mrd0x ), and more!

ANU investigates possible hack after vice-chancellor’s account liked ‘highly offensive’ LinkedIn posts

www.theguardian.com · 1 year, 2 months ago

University spokesperson says Genevieve Bell’s account had ‘liked’ posts she had never seen before about Julie Bishop and Gaza Get our breaking news email, free app or daily news podcast The Australian National University (ANU) has contacted authorities about a possible hacking incident after its vice-chancellor’s account liked a number of “highly offensive” LinkedIn posts about Gaza and Julie Bishop. One of the posts liked by Genevieve Bell’s account was an inflammatory post about Gaza, while another made negative comments about Bishop, the ANU chancellor and a former foreign minister. Sign up for Guardian Australia’s breaking news email Continue reading

Hack the model: Build AI security skills with the GitHub Secure Code Game

github.blog · 1 year, 2 months ago

Dive into the novel security challenges AI introduces with the open source game that over 10,000 developers have used to sharpen their skills.

Last Week in Security (LWiS) - 2025-06-02

blog.badsectorlabs.com · 1 year, 2 months ago

Stealth syscalls ( @darkrelaylabs ), VM introspection ( @memn0ps ), Marebackup LPE ( @itm4n ), Azure Arc C2 ( @ZephrFish ), Obfusk8 ( @x86byte ), and more!

Last Week in Security (LWiS) - 2025-05-27

blog.badsectorlabs.com · 1 year, 2 months ago

BadSuccessor ( @YuG0rd ), o3 finds SMB 0day ( @seanhn ), crashing defender ( @InfoGuardLabs ), MDT looting ( @Oddvarmoe ), and more!

Russian-led cybercrime network dismantled in global operation

www.theguardian.com · 1 year, 2 months ago

Arrest warrants issued for ringleaders after investigation by police in Europe and North America European and North American cybercrime investigators say they have dismantled the heart of a malware operation directed by Russian criminals after a global operation involving British, Canadian, Danish, Dutch, French, German and US police. International arrest warrants have been issued for 20 suspects, most of them living in Russia, by European investigators while indictments were unsealed in the US against 16 individuals. Continue reading

What to do if you can’t get into your Facebook or Instagram account

www.theguardian.com · 1 year, 2 months ago

How to prove your identity after your account gets hacked and how to improve security for the future Phone lost or stolen? Practical steps to restore peace of mind UK passport lost or stolen? Here are the steps you need to take Your Facebook or Instagram account can be your link to friends, a profile for your work or a key to other services, so losing access can be very worrying. Here’s what to do if the worst happens. If you have access to the phone number or email account associated with your Facebook or Instagram account, try to reset your password by clicking on the “Forgot password?” link on the main Facebook or Instagram login screen. Follow the instructions in the email or text message you receive. If you no longer have access to the email account linked to your Facebook account, use a device with which you have previously logged into Facebook and go to facebook.com/login/identify. Enter any email address or phone number you might have associated with your account, or find your username which is the string of characters after Facebook.com/ on your page. Click on “No longer have access to these?”, “Forgotten account?” or “Recover” and follow the instructions to prove your identity and reset your password. If your account was hacked, visit facebook.com/hacked or instagram.com/hacked/ on a device you have previously used to log in and follow the instructions. Visit the help with a hacked account page for Facebook or Instagram. Change the password to something strong, long and unique, such as a combination of random words or a memorable lyric or quote. Avoid simple or guessable combinations. Use a password manager to help you remember it and other important details. Turn on two-step verification in the “password and security” section of the Accounts Centre. Use an authentication app or security key for this, not SMS codes. Save your recovery codes somewhere safe in case you lose access to your two-step authentication method. Turn on “unrecognised login” alerts in the “password and security” section of the Accounts Centre, which will alert you to any suspicious login activity. Remove any suspicious “friends” from your account, these could be fake accounts or scammers. If you are eligible, turn on “advanced protection for Facebook” in the “password and security” section of the Accounts Centre. Continue reading

Last Week in Security (LWiS) - 2025-05-19

blog.badsectorlabs.com · 1 year, 2 months ago

Certipy 5 ( @ly4k ), MobileIron pwnage ( @chudyPB ), new CRTO pricing ( @ZeroPointSec ), Volatility 3 parity ( @volatility ), and more!

Firefox Security Response to pwn2own 2025

blog.mozilla.org · 1 year, 2 months ago

At Mozilla, we consider security to be a paramount aspect of the web. This is why not only does Firefox have a long running bug bounty program but also mature … Read more

Last Week in Security (LWiS) - 2025-05-12

blog.badsectorlabs.com · 1 year, 3 months ago

SysAid RCE ( @SinSinology + @watchtowrcyber ), defendnot ( @es3n1n ), iOS widget hacks ( @brycebostwick1 ), Sword of Secrets ( @GiliYankovitch ), and more!