[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write
TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Actualizado hace 1 min
Noticias de ciberseguridad
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
673 notas en castellano e inglés. Quitar filtros
VulnerabilidadesExploits y PoC
[remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE
Ecava_ntegraXor IGX_16.0.701.10 - RCE
VulnerabilidadesExploits y PoC
[webapps] POMS oretnom23v1.0 - SQLi vulnerabilities
POMS oretnom23v1.0 - SQLi vulnerabilities
VulnerabilidadesExploits y PoC
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild.
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts.
VulnerabilidadesHerramientas e investigación
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
Part 1 of this week's saga can be found here.This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerging threats: the watchTowr Platform.What Is A Citrix NetScaler?NetScaler, from…
OperTraitors: How Kubernetes Operators Betray Your Security Posture
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.
Ciberseguridad
Securing the keys to the kingdom: Announcing Executive Threat Detection
This new proactive service joins the suite of retainer offerings to provide dedicated, intelligence-led hunting specifically for your organization’s most high-value IT assets.
Herramientas e investigaciónIA y seguridad
How we found 24 Android vulnerabilities using our open source AI security agent
A look at the targeted AI taskflows behind these findings, the critical Android bugs they uncovered, and how to run the same open-source agent on your own app.
Filtraciones de datosHerramientas e investigación
28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the ShinyHunters group defaced the website. The group…
Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
God damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world apparently knew about Citrix NetScaler CVEs before Citrix had woken up
Ciberseguridad
InjectSetConsole: inyección de código en procesos remotos sin VirtualAllocEx ni WriteProcessMemory
Cuando pensamos en process injection sobre Windows, probablemente la primera cadena que nos viene a la cabeza sea OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread. Es una técnica conocida y, precisamente por eso, una de las cadenas que los EDR llevan años…
Ciberseguridad
3 Consulting Myths Debunked by Unit 42 Experts
Unit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses.
Herramientas e investigaciónIA y seguridad
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.
MacSync under the microscope: new delivery methods and a new payload
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
VulnerabilidadesExploits y PoC
[remote] MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE
MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE
VulnerabilidadesIA y seguridad
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)
Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry.We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas (apparently?) are now using LLMs to find and reproduce…
VulnerabilidadesExploits y PoC
CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer
With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the…
Ciberseguridad
HTTP/3 in Burp Suite - it’s time to find a bigger wordlist
How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for