SecLists.Org Security Mailing List Archive

Nmap Development — Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to Nmap and related projects. Subscribe to nmap-dev here.

• Previous Quarter
• Archived Posts
• RSS Feed
• About List
• nmap-devLatest Posts

Windows 10/11: Ncat: A message sent on a datagram socket was larger than the internal message buffer ... Ken Kayser (Feb 20)
*Describe the bug*
When listening to a port with ncat, as soon as a UDP packet is received, I
receive a constant stream of errors with the following text: "Ncat: A
message sent on a datagram socket was larger than the internal message
buffer or some other network limit, or the buffer used to receive a
datagram into was smaller than the datagram itself. ."

*To Reproduce*

1. In either a Windows command line or Powershell I enter...

Reverse DNS (issue #3007) Matteo Nicoli (Feb 13)
Hi all,

I noticed a cool feature proposal on GitHub (issue 3007 <https://github.com/nmap/nmap/issues/3007>). It basically
suggests a new feature for returning the (complete) list of DNS records obtained — through reverse DNS lookups — from
an IP address. If it matches with the map product roadmap, I’d like to start implementing it. Is there some maintainer
who could give me a brief feedback about it?

Cheers,
Matteo

Re: Mail stoppage Gordon Fyodor Lyon (Feb 12)
Yes, this was my fault. Mail to the Nmap dev list from non-subscribers
goes through moderation to keep out the spam. I regularly go through the
moderation queue to find and approve the "real" messages, but I was a bit
slow this time. We strongly recommend that folks posting to the list first
subscribe to it. This avoids the moderation delay and prevents them from
missing any responses which might only be sent to the list.

Cheers,...

Mail stoppage Dave Close (Feb 12)
Several messages received today seem to have been stuck on nmap.org for
up to a month. Example (edited for clarity):

Version: 7.94+SVN TypeError: Couldn't find foreign struct converter for 'cairo.Context' Hendrick Halim (Feb 12)
Version: 7.94+SVN
TypeError: Couldn't find foreign struct converter for 'cairo.Context'

topology tab crash Genny and Doug Kent (Feb 12)
zenmap crashes when topology tab clicked.

Output message below

Version: 7.94+SVN
TypeError: Couldn't find foreign struct converter for 'cairo.Context'

Doug Kent

PR #2954, Fix out of bounds reads in packet parsing Domen Puncer Kugler via dev (Feb 12)
Hi,

I've submitted a pull request a few months ago:
https://github.com/nmap/nmap/pull/2954

The PR includes following three commits:
- Fix out of bounds read in HopByHopHeader::validate
- Fix out of bounds read in PacketParser::split
- Add AFL test code for PacketParser

This was found as a part of a short Hackathon at NCC Group.
As far as I can tell, there is no security impact, but it would still be nice
to see this fixed.

Kind regards

High-Priority HTML Parsing script astrotoki via dev (Feb 12)
Hello,

I noticed that under the high priority script ideas was the need for a library that parses HTML info from sites. I
wrote a script that uses a web crawler and extracts html info from attached pages and accompanying urls within the html
body. Let me know if this is what yall were after?

Thanks!
Ryan LaPierre <Astro>_______________________________________________
Sent through the dev mailing list...

URL Pathfinder astrotoki via dev (Feb 12)
Hello all!

I just wrote up another script, trying to practice and maybe have some added to the master list for nmap. This script
enumerates possible hidden path extensions on urls. As always, Id love input on it, changes or updates.

Thanks all!
Ryan LaPierre <Astro>_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/

Null Byte Poisoning NSE astrotoki via dev (Feb 12)
Here is my submission of a script I wrote that should test a site for null byte poisoning vulnerabilities._______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/

Re: First Go astrotoki via dev (Feb 12)
Here is an updated version with more XSS patterns integrated into it. As well as some clean up!

I also created a separate .lua with just the http crawler function.

Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/

First Go astrotoki via dev (Feb 12)
Hello!,

I just started learning Lua for writing NSEs and had a go at a HTTP crawler that identifies XSS vulnerabilities on
sites. I used Juice-Shop OWASP to confirm it works. (Thats why the source code uses port 3000 in addition to 80) Id
love feedback! Doing my best to learn as much as I can. I attached the http_xss_crawler.nse below!

PS. I had used ChatGPTo1 and Github CoPilot to aid in debugging and syntax issues. The overall code is my...

Re: [PATCH] nping: bind to interface on Linux for IPv4 send-ip Daniel Miller (Feb 10)
Thanks, Valdik! I reviewed the code and moved the call to
socket_bindtodevice() to ProbeMode::start() so that it will affect all
modes, not just TCP. The change is in r39078.

Dan

High-Priority HTML Parsing script astrotoki via dev (Jan 28)
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/

Post Quantum hackathon and nmap Loganaden Velvindron (Dec 09)
Hi Folks,

I'm logan from the cyberstorm.mu team. We have opened several PRs for
nmap to improve support for Post Quantum algorithms:

https://github.com/nmap/nmap/pull/2977
https://github.com/nmap/nmap/pull/2978
https://github.com/nmap/nmap/pull/2987

We are working on other PRs for PQ which we will send in due time.
Feedback is welcome and we are willing to commit time to improve our
PRs.

Kind regards,
Logan
(On behalf of the...

Nmap Announce — Moderated list for the most important new releases and announcements regarding the Nmap Security Scanner and related projects. We recommend that all Nmap users subscribe to stay informed.

• Current Year
• Archived Posts
• RSS Feed
• About List
• nmap-announceLatest Posts

Npcap Version 1.82 Released with VLAN Tagging and More Gordon Fyodor Lyon (Apr 28)
Dear Nmap Community,

In preparation for an imminent Nmap release (hopefully this week!), we have
released Version 1.82 of our Npcap Windows packet capture and transmission
driver. It builds upon the recent 1.81 release to add support for VLAN
tagging. This allows you to select for packets directed to a certain VLAN
or just inspect the VLAN headers on any packets received. It's especially
useful for Wireshark users. You can also now send...

Nmap 7.95 released: OS and service detection signatures galore! Gordon Fyodor Lyon (May 05)
Dear Nmap Community,

I just arrived in San Francisco for the RSA conference and am delighted to
announce our Nmap Version 7.95 release! I'm most excited that we finally
tackled our backlog of OS and service detection fingerprint submissions.
We're not talking about dozens or hundreds of them-we processed more than
6,500 fingerprints!

For OS detection, we added 336 signatures, bringing the new total to 6,036.
Additions include iOS 15...

Full Disclosure — A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

• Current Month
• Archived Posts
• RSS Feed
• About List
• fulldisclosureLatest Posts

SEC Consult SA-20250521-0 :: Multiple Vulnerabilities in eCharge Hardy Barth cPH2 and cPP2 charging stations SEC Consult Vulnerability Lab via Fulldisclosure (May 27)
SEC Consult Vulnerability Lab Security Advisory < 20250521-0 >
=======================================================================
title: Multiple Vulnerabilities
product: eCharge Hardy Barth cPH2 and cPP2 charging stations
vulnerable version: 2.2.0
fixed version: Not available
CVE number: CVE-2025-27803, CVE-2025-27804, CVE-2025-48413,
CVE-2025-48414, CVE-2025-48415,...

Structured Query Language Injection in frappe.desk.reportview.get_list Endpoint in Frappe Framework Ron E (May 27)

An authenticated SQL injection vulnerability exists in the frappe.desk.reportview.get_list API of the Frappe Framework,
affecting versions v15.56.1. The vulnerability stems from improper sanitization of the fields[] parameter, which allows
low-privileged users to inject arbitrary SQL expressions directly into the SELECT clause.

Sample Structured Query Language Injection:

Request:

GET...

Unauthenticated Blind SQL Injection | RSI queue management system - V 3.0 | CVE-2025-26086 Shaikh Shahnawaz (May 16)
[+] Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC
[+] twitter.com/_striv3r_

[Vendor of Product]
RSI Queue (https://www.rsiqueue.com/)

[Vulnerability Type]
Blind SQL Injection

[Affected Component]
The vulnerable component is the TaskID parameter in the get request.

[CVE Reference]
CVE-2025-26086

[Security Issue]
An unauthenticated blind SQL injection vulnerability exists in RSI Queue
Management System v3.0 within the...

CVE-2025-30072 Tiiwee X1 Alarm System - Authentication Bypass by Capture-replay Sebastian Auwärter via Fulldisclosure (May 16)
Advisory ID: SYSS-2025-006
Product: Tiiwee X1 Alarm System
Manufacturer: Tiiwee B.V.
Affected Version(s): TWX1HAKV2
Tested Version(s): TWX1HAKV2
Vulnerability Type: Authentication Bypass by Capture-replay
(CWE-294)
Risk Level: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Solution Status: Open
Manufacturer Notification: 2025-01-27...

SEC Consult SA-20250506-0 :: Honeywell MB Secure Authenticated Command Injection SEC Consult Vulnerability Lab via Fulldisclosure (May 16)
SEC Consult Vulnerability Lab Security Advisory < 20250507-0 >
=======================================================================
title: Authenticated Command Injection
product: Honeywell MB-Secure
vulnerable version: MB-Secure versions from V11.04 and prior to V12.53,
MB-Secure PRO versions from V01.06 and prior to V03.09
fixed version: MB-Secure v12.53, MB-Secure PRO v03.09
CVE number:...

SEC Consult SA-20250429-0 :: Multiple Vulnerabilities in HP Wolf Security Controller and more SEC Consult Vulnerability Lab via Fulldisclosure (May 16)
SEC Consult Vulnerability Lab Security Advisory < publishing date 20250429-0 >
Combined Security Advisory for Sure Access Enterprise and Sure Click Enterprise
=======================================================================
title: Multiple Vulnerabilities
product: HP Wolf Security Controller / HP Sure Access Enterprise /
HP Sure Click Enterprise
vulnerable version: HP Wolf Security...

SEC Consult SA-20250422-0:: Local Privilege Escalation via DLL Search Order Hijacking SEC Consult Vulnerability Lab via Fulldisclosure (May 16)
SEC Consult Vulnerability Lab Security Advisory < 20250422-0 >
=======================================================================
title: Local Privilege Escalation via DLL Search Order Hijacking
product: Ivanti Endpoint Manager Security Scan (Vulscan) Self
Update
vulnerable version: EPM 2022 SU6 and previous, EPM 2024
fixed version: EPM 2022 SU7 and EPM 2024 SU1
CVE number: CVE-2025-22458...

Session Invalidation in Economizzer Allows Unauthorized Access After Logout Ron E (May 16)
A session management vulnerability exists in gugoan's Economizzer
v.0.9-beta1. The application fails to properly invalidate user sessions
upon logout or other session termination events. As a result, a valid
session remains active and usable even after the user has attempted to log
out.

POST /web/category/create HTTP/2

Host: <host>

Cookie: _economizzerSessionId=<<REDACTED>>;

Persistent Cross-Site Scripting in Economizzer Category Entry Ron E (May 16)
A persistent cross-site scripting (XSS) vulnerability exists in gugoan's
Economizzer v.0.9-beta1. The application fails to properly sanitize
user-supplied input when creating a new category via the
*category/create *endpoint.
An attacker can inject malicious JavaScript payloads that are permanently
stored and later executed in the context of any user who views the affected
entry.

https://<host>/web/category/create

POST...

Persistent Cross-Site Scripting in Economizzer Cashbook Entry Ron E (May 16)
A persistent cross-site scripting (XSS) vulnerability exists in gugoan's
Economizzer v.0.9-beta1 The application fails to properly sanitize
user-supplied input when creating a new cash book entry via the
*cashbook/create* endpoint. An attacker can inject malicious JavaScript
payloads that are permanently stored and later executed in the context of
any user who views the affected entry.

https://<host>/web/cashbook/create

POST...

APPLE-SA-05-12-2025-9 Safari 18.5 Apple Product Security via Fulldisclosure (May 16)
APPLE-SA-05-12-2025-9 Safari 18.5

Safari 18.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122719.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Ventura and macOS Sonoma
Impact: A type confusion issue could lead to memory corruption
Description: This...

APPLE-SA-05-12-2025-8 visionOS 2.5 Apple Product Security via Fulldisclosure (May 16)
APPLE-SA-05-12-2025-8 visionOS 2.5

visionOS 2.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122721.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: Apple Vision Pro
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination...

APPLE-SA-05-12-2025-7 tvOS 18.5 Apple Product Security via Fulldisclosure (May 16)
APPLE-SA-05-12-2025-7 tvOS 18.5

tvOS 18.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122720.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted media file may lead to
unexpected...

APPLE-SA-05-12-2025-6 watchOS 11.5 Apple Product Security via Fulldisclosure (May 16)
APPLE-SA-05-12-2025-6 watchOS 11.5

watchOS 11.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122722.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted media file may lead to
unexpected app...

APPLE-SA-05-12-2025-5 macOS Ventura 13.7.6 Apple Product Security via Fulldisclosure (May 16)
APPLE-SA-05-12-2025-5 macOS Ventura 13.7.6

macOS Ventura 13.7.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122718.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

afpfs
Available for: macOS Ventura
Impact: Mounting a maliciously crafted AFP network share may lead to
system...

Bugtraq — The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!

• Archived Posts
• RSS Feed
• About List

Security Basics — A high-volume list which permits people to ask "stupid questions" without being derided as "n00bs". I recommend this list to network security newbies, but be sure to read Bugtraq and other lists as well.

• Archived Posts
• RSS Feed
• About List

Penetration Testing — While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing.

• Archived Posts
• RSS Feed
• About List

Info Security News — Carries news items (generally from mainstream sources) that relate to security.

• Archived Posts
• RSS Feed
• About List

Firewall Wizards — Tips and tricks for firewall administrators

• Archived Posts
• RSS Feed
• About List

IDS Focus — Technical discussion about Intrusion Detection Systems. You can also read the archives of a previous IDS list

• Archived Posts
• RSS Feed
• About List

Web App Security — Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more.

• Archived Posts
• RSS Feed
• About List

Daily Dave — This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by ImmunitySec founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• dailydaveLatest Posts

Typey typey Dave Aitel via Dailydave (May 27)
https://www.linkedin.com/mwlite/feed/posts/daveaitel_for-the-offensive-information-professionals-activity-7331470514927865856-
<https://www.linkedin.com/mwlite/feed/posts/daveaitel_for-the-offensive-information-professionals-activity-7331470514927865856-yRnO>
yRnO

So I wanted to point this contracting gig out because I think it's a good
opportunity for someone who can do quick vulnerability triage and either
replicate or disprove that...

Announcing the Parity Release of Volatility 3 and the Deprecation of Volatility 2 Andrew Case via Dailydave (May 27)
The Volatility Team is very excited to announce the official Parity
Release of Volatility 3!

This release is not only capable of fully replacing all of Volatility
2’s features, but it also incorporates support for all the latest
operating system versions plus all the latest memory forensics
research.

With this release, Volatility 2 is now deprecated, and its GitHub
project has been archived.

Our announcement blog post details the new...

Re: Typey typey Dave Aitel via Dailydave (May 27)
https://www.linkedin.com/jobs/view/4233405535/

I am bad at links it seems ? Anyways, clicky clicky assuming you are the
type of person who uses Binja for fun and maybe a little bit of profit.

Also here is the OffensiveCon25 Youtube List - it's amazing to me they
managed to get these out so soon.
https://youtu.be/kF31SYIVob8?si=QWPps_--UsILr0mR

-dave

OpenAI Security Research Dave Aitel via Dailydave (Mar 28)
So a few things:
1. https://openai.com/index/security-on-the-path-to-agi/ I feel like this
blog is worth reading. :)
2. We're throwing a post-RSAC conference in SanFran to talk about AI and
Security (in particular, securing cybery things with AI) and if I'm very
lucky I'll even get to do a quick demo of the software I've been working
on, not that it will surprise anyone on this list! We have a few tickets
left I think and if...

Re: Cyber Reasoning Systems A K via Dailydave (Mar 28)
Have you already reviewed https://github.com/open-crs ?

Cyber Reasoning Systems Dave Aitel via Dailydave (Mar 04)
I continue to believe there are a lot of interesting questions around
building cyber reasoning systems for vuln finding. Even the very basics
seem hard to study and understand, and the eval datasets available
are....sparse or incomplete. For example, what you really want if you're
analyzing git repos is the commit a bug was introduced, and the commit it
was fixed. But usually you get "a commit where it maybe existed".

Likewise,...

on your child going to college in Christchurch, NZ and velvet worms Dave Aitel via Dailydave (Feb 11)
*on your child going to college in Christchurch, NZ and velvet worms*

By mid‑August the garden already practices absence — stems turning hollow,
the robin leaving its notes hanging in the air like torn corners of a song.
Under the chirp of palmetto bugs, a log eases itself back into earth.
Inside, hidden from the light, a velvet worm does the impossible: offers
herself to a spill of pale, blind threads. For days she is nothing but
hunger...

Re: (the root of the root and the bud of the bud) Sean Heelan via Dailydave (Jan 13)
As it happens, I’ve found the most effective way to use LLMs is to de-anthropomorphise them entirely and treat them
very like fuzzers (large scale generation of results, lots of false positives/nonsense, filtered by some oracle).

The “conversation with an AI” approach where you imagine yourself as having a single artificial brain to interact with
is (currently at least) practically far less useful than one in which you are content with...

Anthropological "Hacker" Map A K via Dailydave (Jan 13)
Hi all,

In the latest "Security Weekly" (https://www.youtube.com/watch?v=CXefYdEGW04
)
they present the Anthropological "Hacker" Map
https://wherewarlocksstayuplate.com/map/

While the map is incomplete (how can it ever be complete?), I think it is
one of the few times, outside of David Aitel's writings about the cross-cut
between the "underground" (for a lack of a better term) and subsequent
commercial...

Re: (the root of the root and the bud of the bud) Don A. Bailey via Dailydave (Jan 12)
I designed one of the first working fuzzers (albeit unintentionally) back
in the late 90's. I don't remember if I published it, but I still have the
code. It, however, worked - badly - but it worked. I was heavily flamed,
however, because as you stated - it was not hip. It only attacked
environment variable and command-line argument based vulnerabilities. But,
in the 90's and early 00's, we had no shortage of local suid-based...

Re: (the root of the root and the bud of the bud) Thomas Dullien via Dailydave (Jan 12)
Hey,

I have one quibble: We are using "reasoning" in a qualitative, not
descriptive, form here -- "fuzzing is or is not reasoning", "LLMs reason or
do not reason". I am not sure this is helpful. Fuzzing is empirically
successful at finding crashes. Somebody that needs to light a fire and
smashes two stones together until they throw sparks does not, once the fire
burns, need to justify that 'stones perform...

Re: (the root of the root and the bud of the bud) Darren Bounds via Dailydave (Jan 12)
Everything old is new and the way we reason is the same way LLMs reason. It's
not about looking for the same problem the same way it's about going to
searching for that flaw the same way with unlimited (nearly) resources.

Traditional human-led vulnerability research and discovery is, today, a short
lived venture.

Things will change very rapidly over the coming 24 months.

Memories and thoughts are the same thing, someone tried to...

(the root of the root and the bud of the bud) Dave Aitel via Dailydave (Jan 11)
Memories and thoughts are the same thing, someone tried to explain to me
recently. You have to think to remember, in other words. This is hard to
grasp for a lot of people because they *think *they have *memories*. They
wrongly think memory is a noun instead of a verb, which is ok in philosophy
and psychology but in cutting edge computer science we have to be precise
about these sorts of things.

Twenty-five years ago, when I first started...

PaulDotCom — General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast.

• Archived Posts
• RSS Feed
• About List

Honeypots — Discussions about tracking attackers by setting up decoy honeypots or entire honeynet networks.

• Archived Posts
• RSS Feed
• About List

Microsoft Sec Notification — Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products—note how most have a prominent and often-misleading "mitigating factors" section.

• Archived Posts
• RSS Feed
• About List

Funsec — While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community

• Archived Posts
• RSS Feed
• About List

CERT Advisories — The Computer Emergency Response Team has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists.

• Archived Posts
• RSS Feed
• About List
• certLatest Posts

Apple Releases Security Updates for Multiple Products CISA (Mar 28)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated and is now available.

Apple Releases Security Updates for Multiple Products [
https://www.cisa.gov/news-events/alerts/2023/03/28/apple-releases-security-updates-multiple-products ] 03/28/2023 01:00
PM EDT

Apple...

CISA Releases Six Industrial Control Systems Advisories CISA (Mar 23)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Six Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/23/cisa-releases-six-industrial-control-systems-advisories ] 03/23/2023
08:00 AM EDT...

CISA Releases Eight Industrial Control Systems Advisories CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Eight Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories ]
03/21/2023 08:00 AM...

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...

Open Source Security — Discussion of security flaws, concepts, and practices in the Open Source community

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• oss-secLatest Posts

CVE-2025-46701: Apache Tomcat: Security constraint bypass for CGI scripts Mark Thomas (May 29)
Severity: low

Affected versions:

- Apache Tomcat 11.0.0-M1 through 11.0.6
- Apache Tomcat 10.1.0-M1 through 10.1.40
- Apache Tomcat 9.0.0.M1 through 9.0.104

Description:

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's
GCI servlet allows security constraint bypass of security constraints
that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1...

Local information disclosure in apport and systemd-coredump Qualys Security Advisory (May 29)
Qualys Security Advisory

Local information disclosure in apport and systemd-coredump
(CVE-2025-5054 and CVE-2025-4598)

========================================================================
Contents
========================================================================

Summary
Mitigation
Local information disclosure in apport (CVE-2025-5054)
- Background
- Analysis
- Proof of concept
Local information disclosure in systemd-coredump...

Re: CVE-2025-5278: Heap Buffer Overflow in GNU Coreutils sort Alan Coopersmith (May 29)
An excellent question, but I don't know if the people who were involved in
making the decision are on this list. (I wasn't, and was just passing on
the information I'd found.)

https://www.cve.org/CVERecord?id=CVE-2025-5278 says that Red Hat was the CNA
who issued the CVE - perhaps they have some insight?

Re: CVE-2025-5278: Heap Buffer Overflow in GNU Coreutils sort Simon McVittie (May 29)
On Tue, 27 May 2025 at 14:43:44 -0700, Alan Coopersmith forwarded:

How would an attacker trigger this? Is this only exploitable if the
attacker has control over the sort key (equivalent of -k), *and* the key
is passed in to sort(1) via the traditional +POS syntax rather than the
POSIX -k option?

I ask because, if there's no reasonable scenario where this is
attacker-triggerable, then this would not be a security vulnerability
but...

Re: ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803) Jakub Wilk (May 28)
* Matthias Gerstner <mgerstner () suse de>, 2025-05-28 19:21:

Default ACLs to the rescue!

$ chmod a+x ~
$ mkdir -m 777 ~/.Private
$ setfacl -d -m u:$LOGNAME:rwx ~/.Private/
$ curl -s -H "Content-Type: application/json" -d '{ "command": "config-write", "arguments": { "filename":
"'"$HOME"'/.Private/libexploit.so" } }' localhost:8000 > /dev/null
$...

how to unsubscribe (Re: ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803)) Solar Designer (May 28)
I am sorry for letting this one through, which happened in error. Of
course, we (the moderators) normally reject misaddressed unsubscription
requests like that (but do unsubscribe the people manually, and we did
this time too).

If anyone else wants to unsubscribe, the robot address to do that is
listed in this header:

List-Unsubscribe: <mailto:oss-security-unsubscribe () lists openwall com>

So you send any message to...

RE: ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803) Jounee Kim (May 28)
UNSUBSCRIBE

From: Andrei Pavel <andrei () isc org>
Sent: Wednesday, May 28, 2025 12:34 PM
To: oss-security () lists openwall com
Cc: security-officer () isc org
Subject: [oss-security] ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803)

On 28 May 2025 we (Internet Systems Consortium) disclosed three vulnerabilities affecting our Kea software: -
CVE-2025-32801:  Loading a malicious hook...

Re: ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803) Matthias Gerstner (May 28)
Hello list,

we originally reported these issues to upstream and would like to share
our full report below.

This is a report about local security issues in the Kea DHCP server suite.
During a routine review we found a local root exploit and a number of further
local vulnerabilities in its REST API, affecting Kea packages found in many
Linux and BSD distributions.

Upstream pre-disclosed these issues to the distros mailing list on 2025-05-15
and...

ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801, CVE-2025-32802, CVE-2025-32803) Andrei Pavel (May 28)
On 28 May 2025 we (Internet Systems Consortium) disclosed three
vulnerabilities affecting our Kea software:

- CVE-2025-32801:       Loading a malicious hook library can lead to
local privilege escalation https://kb.isc.org/docs/cve-2025-32801
- CVE-2025-32802:       Insecure handling of file paths allows multiple
local attacks https://kb.isc.org/docs/cve-2025-32802
- CVE-2025-32803:       Insecure file permissions can result...

CVE-2025-48734: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default Gary D. Gregory (May 28)
Severity: important

Affected versions:

- Apache Commons BeanUtils 1.x 1.0 before 1.11.0
- Apache Commons BeanUtils 2.x 2.0.0-M1 before 2.0.0-M2

Description:

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared
class property of Java enum objects to get access to the classloader. However this protection was not enabled...

[SECURITY ADVISORY] curl: No QUIC certificate pinning with wolfSSL Daniel Stenberg (May 27)
No QUIC certificate pinning with wolfSSL
========================================

Project curl Security Advisory, May 28 2025 -
[Permalink](https://curl.se/docs/CVE-2025-5025.html)

VULNERABILITY
-------------

libcurl supports *pinning* of the server certificate public key for HTTPS
transfers. Due to an omission, this check is not performed when connecting
with QUIC for HTTP/3, when the TLS backend is wolfSSL.

Documentation says the option...

[SECURITY ADVISORY] curl: QUIC certificate check skip with wolfSSL Daniel Stenberg (May 27)
QUIC certificate check skip with wolfSSL
========================================

Project curl Security Advisory, May 28 2025 -
[Permalink](https://curl.se/docs/CVE-2025-4947.html)

VULNERABILITY
-------------

libcurl accidentally skips the certificate verification for QUIC connections
when connecting to a host specified as an IP address in the URL. Therefore, it
does not detect impostors or man-in-the-middle attacks.

INFO
----

curl can get...

CVE-2025-27528: Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read Charles Zhang (May 27)
Severity: moderate

Affected versions:

- Apache InLong 1.13.0 through 2.1.0

Description:

Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0.

This
vulnerability allows attackers to bypass the security mechanisms of InLong
JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to
solve it.

[1]...

CVE-2025-27522: Apache InLong: JDBC Vulnerability during verification processing Charles Zhang (May 27)
Severity: moderate

Affected versions:

- Apache InLong 1.13.0 through 2.1.0

Description:

Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for
CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1]

https://github.com/apache/inlong/pull/11732

Credit:

yulate...

CVE-2025-27526: Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass Charles Zhang (May 27)
Severity: moderate

Affected versions:

- Apache InLong 1.13 through 2.1.0

Description:

Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability
URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/11747...

Secure Coding — The Secure Coding list (SC-L) is an open forum for the discussion on developing secure applications. It is moderated by the authors of Secure Coding: Principles and Practices.

• Archived Posts
• RSS Feed
• About List

Educause Security Discussion — Securing networks and computers in an academic environment.

• Archived Posts
• RSS Feed
• About List

NANOG — The North American Network Operators' Group discusses fundamental Internet infrastructure issues such as routing, IP address allocation, and containing malicious activity.

• Current Month
• Archived Posts
• RSS Feed
• About List
• nanogLatest Posts

Re: Amazon AWS cloudfront WAF block Mike Hammett via NANOG (May 29)
WISPA may be the closest thing we have to an SMB ISP union.

-----
Mike Hammett
Intelligent Computing Solutions
http://www.ics-il.com

Midwest-IX
http://www.midwest-ix.com

----- Original Message -----
From: "Alex Buie via NANOG" <nanog () lists nanog org>
To: "North American Network Operators Group" <nanog () lists nanog org>
Cc: "John Levine" <johnl () iecc com>, "Alex Buie" <abuie ()...

Re: Amazon AWS cloudfront WAF block Alex Buie via NANOG (May 29)
FWIW we regularly face this at $DAYJOB as a mid-sized nationwide business
ISP and have all but given up. Ticketmaster, Hulu, Disney, and others which
seem to use Neustar or IPQS simply seem uninterested in our mutual
customers being able to do business with them. Ticketmaster suggested we
ask our customers switch to their cellular hotspot to purchase tickets
since “Verizon and AT&T run a tested and secure network”. Implying I don’t
but...

Re: Amazon AWS cloudfront WAF block Tom Beecher via NANOG (May 29)
It won't, no. But not much else will either.

AWS default WAF lists are notoriously bad. They often include things they
shouldn't. If you are an AWS customer they'll tell you to make your own
edits to fix these problems. If you aren't (as in the OP's case ), they
won't even really talk to you, as the OP experienced.

It's of course exceptionally frustrating when you're in the OP's shoes with
this...

Re: Amazon AWS cloudfront WAF block Mike Hammett via NANOG (May 29)
People don't want to resolve issues. They want to argue and be correct.

-----
Mike Hammett
Intelligent Computing Solutions
http://www.ics-il.com

Midwest-IX
http://www.midwest-ix.com

----- Original Message -----
From: "Mu via NANOG" <nanog () lists nanog org>
To: "North American Network Operators Group" <nanog () lists nanog org>
Cc: "John Levine" <johnl () iecc com>, "Mu" <mu ()...

Re: Engineering problems, not legal problems [was: Amazon AWS cloudfront WAF block] Tom Beecher via NANOG (May 29)
The last engineering solution is always the one right before the lawyers
get involved.

Re: Amazon AWS cloudfront WAF block Tom Beecher via NANOG (May 29)
I'll take my prelaw classes in college over your Wikipedia University,
thanks.

Re: Engineering problems, not legal problems [was: Amazon AWS cloudfront WAF block] patrick via NANOG (May 29)
First, no company I know or have even heard of would let an engineer send a demand letter. Only lawyers do that. Also,
most companies (all? at least all big companies - to a first approximation) have rules around “if the other side
involves a lawyer, we have to engage one on our side”. If by some miracle an engineer did send the demand letter, it
would almost certainly still trigger legal involvement on the receiving end, which changes the...

Re: Amazon AWS cloudfront WAF block Eric C. Miller via NANOG (May 29)
Bill, that's the typical definition that I've used and it's what I'm referring to in this type of relationship.
Reiterated, "This threat list service is labeling my customer as a threat, and that is interfering with my ability to
enable them to reach the entire internet." Lots of details are not said, it is a high standard to meet, but it is a
term that "their guys" understand, which is usually enough to...

Re: Engineering problems, not legal problems [was: Amazon AWS cloudfront WAF block] William Herrin via NANOG (May 29)
Hi Patrick,

The point of demand letters is to cut through the bureaucracy to that
"knowledgeable person" you mentioned. When the organization offers
more reasonable ways to reach that "knowledgeable person," demand
letters are rarely necessary. You can think of a demand letter as the
last engineering solution you try before falling back on legal
processes to compel change.

Regards,
Bill Herrin

routenator and krill log filter Randy Bush via NANOG (May 29)
i get nightly log reportd from rpki servers of various flavors. two,
see $ubject, seem to be popular enough that others may have tooling
to help.

for each, i want log filters/analysers which tell me about bad things i
can do something about. i do not care about the 42,000 sick servers out
there as i do not have time to fix the world. i do not care about
things not needing action on *my* part. i expect/hope for a null report
most days. i do...

Re: Amazon AWS cloudfront WAF block William Herrin via NANOG (May 29)
https://en.wikipedia.org/wiki/Tortious_interference

"As an example, someone [...] could obstruct someone's ability to
honor a contract with a client by deliberately refusing to deliver
necessary goods."

I hate using wikipedia to "prove" a point, but if you want to
understand something in plain language it's a pretty good place to
start reading.

Regards,
Bill Herrin

Re: Amazon AWS cloudfront WAF block Eric C. Miller via NANOG (May 29)
Andrew,

I respect everyone's right to block my traffic. It's mere courtesy for them to at least say that so we can relay that
insensitivity to our customers. PR nightmares are bad regardless of who starts them. As others have shared in my
absence, I only desire that companies would explain why we're being blocked so we can knock the bad actors off our
network. In the case of Amazon, Target, Disney, Netflix, Chase, BoA, and...

Re: Amazon AWS cloudfront WAF block William Herrin via NANOG (May 29)
Hi John,

That is correct as far as it goes. However, if I *tell you* that
you're hurting me and your response is, "I don't believe you and I
can't be bothered to check," you are acting in bad faith. That doesn't
necessarily make it unlawful, but any protections you had based on
"good faith" are out the window. That's how Cox got smacked around in
their piracy lawsuit: they reacted to notification in...

Re: Amazon AWS cloudfront WAF block Mu via NANOG (May 29)
Respectfully, is anyone here an actual lawyer giving legal advice?

If not, can we maybe just suggest that everyone consults with their own lawyers about what actions they do or do not
want to take?

Obviously the original comment about sending a legal letter was made out of frustration because reaching an actual
human at some of these megacorps is often like pulling teeth. I don't blame them for being frustrated. With that said,
I cannot...

Re: Amazon AWS cloudfront WAF block Tom Beecher via NANOG (May 29)
Without attempting to actually clarify what tortious interference actually
is, let's just make it clear that Bill's attempted explanation isn't it.

Interesting People — David Farber moderates this list for discussion involving internet governance, infrastructure, and any other topics he finds fascinating

• Archived Posts
• RSS Feed
• About List

The RISKS Forum — Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• risksLatest Posts

Risks Digest 34.66 RISKS List Owner (May 29)
RISKS-LIST: Risks-Forum Digest Thursday 29 May 2025 Volume 34 : Issue 66

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.66>
The current issue can also be found at
<...

Risks Digest 34.65 RISKS List Owner (May 27)
RISKS-LIST: Risks-Forum Digest Tuesday 27 May 2025 Volume 34 : Issue 65

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.65>
The current issue can also be found at
<...

Risks Digest 34.63 RISKS List Owner (May 17)
RISKS-LIST: Risks-Forum Digest Saturday 17 May 2025 Volume 34 : Issue 63

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.63>
The current issue can also be found at
<...

Risks Digest 34.62 RISKS List Owner (May 11)
RISKS-LIST: Risks-Forum Digest Sunday 11 May 2025 Volume 34 : Issue 62

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.62>
The current issue can also be found at
<...

Risks Digest 34.61 RISKS List Owner (Apr 18)
RISKS-LIST: Risks-Forum Digest Friday 18 April 2025 Volume 34 : Issue 61

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.61>
The current issue can also be found at
<...

Risks Digest 34.60 RISKS List Owner (Apr 01)
RISKS-LIST: Risks-Forum Digest Tuesday 1 April 2025 Volume 34 : Issue 60

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.60>
The current issue can also be found at
<...

Risks Digest 34.58 RISKS List Owner (Mar 15)
RISKS-LIST: Risks-Forum Digest Saturday 15 Mar 2025 Volume 34 : Issue 58

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.58>
The current issue can also be found at
<...

Risks Digest 34.56 RISKS List Owner (Feb 16)
RISKS-LIST: Risks-Forum Digest Sunday 16 Feb 2025 Volume 34 : Issue 56

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.56>
The current issue can also be found at
<...

Risks Digest 34.54 RISKS List Owner (Feb 06)
RISKS-LIST: Risks-Forum Digest Thursday 6 Jan 2025 Volume 34 : Issue 54

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.54>
The current issue can also be found at
<...

Risks Digest 34.53 RISKS List Owner (Jan 26)
RISKS-LIST: Risks-Forum Digest Sunday 26 Jan 2025 Volume 34 : Issue 53

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.53>
The current issue can also be found at
<...

(no subject) RISKS List Owner (Jan 11)
Risks Digest 34.52

RISKS-LIST: Risks-Forum Digest Saturday 11 January 2025 Volume 34 : Issue 52

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.52>
The current issue can also be found at...

BreachExchange — BreachExchange focuses on all things data breach. Topics include actual data breaches, cyber insurance, risk management, metrics and more. This archive includes its predecessor, the Data Loss news and discussion lists.

• Archived Posts
• RSS Feed
• About List
• datalossLatest Posts

Healthcare organizations face rising ransomware attacks – and are paying up Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/healthcare-ransomware-pay-sophos/

Healthcare organizations, already an attractive target for ransomware given
the highly sensitive data they hold, saw such attacks almost double between
2020 and 2021, according to a survey released this week by Sophos.

The outfit's team also found that while polled healthcare orgs are quite
likely to pay ransoms, they rarely get all of their data returned if they
do...

A digital conflict between Russia and Ukraine rages on behind the scenes of war Matthew Wheeler (Jun 03)
https://wskg.org/npr_story_post/a-digital-conflict-between-russia-and-ukraine-rages-on-behind-the-scenes-of-war/

SEATTLE — On the sidelines of a conference in Estonia on Wednesday, a
senior U.S. intelligence official told British outlet Sky News that the
U.S. is running offensive cyber operations in support of Ukraine.

“My job is to provide a series of options to the secretary of defense and
the president, and so that’s what I do,” said...

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network Matthew Wheeler (Jun 03)
https://thehackernews.com/2022/06/researchers-uncover-malware-controlling.html

The Parrot traffic direction system (TDS) that came to light earlier this
year has had a larger impact than previously thought, according to new
research.

Sucuri, which has been tracking the same campaign since February 2019 under
the name "NDSW/NDSX," said that "the malware was one of the top infections"
detected in 2021, accounting for more than...

FBI, CISA: Don't get caught in Karakurt's extortion web Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/fbi_cisa_warn_karakurt_extortion/

The Feds have warned organizations about a lesser-known extortion gang
Karakurt, which demands ransoms as high as $13 million and, some
cybersecurity folks say, may be linked to the notorious Conti crew.

In a joint advisory [PDF] this week, the FBI, CISA and US Treasury
Department outlined technical details about how Karakurt operates, along
with actions to take,...

DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/06/doj-seizes-3-web-domains-used-to-sell.html

The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of
three domains used by cybercriminals to trade stolen personal information
and facilitate distributed denial-of-service (DDoS) attacks for hire.

This includes weleakinfo[.]to, ipstress[.]in, and ovh-booter[.]com, the
former of which allowed its users to traffic hacked personal data and
offered a...

Chinese Hackers Begin Exploiting Latest Microsoft Office Zero-Day Vulnerability Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/05/chinese-hackers-begin-exploiting-latest.html

An advanced persistent threat (APT) actor aligned with Chinese state
interests has been observed weaponizing the new zero-day flaw in Microsoft
Office to achieve code execution on affected systems.

"TA413 CN APT spotted [in-the-wild] exploiting the Follina zero-day using
URLs to deliver ZIP archives which contain Word Documents that use the
technique,"...

US military hackers conducting offensive operations in support of Ukraine, says head of Cyber Command Matthew Wheeler (Jun 02)
https://www.three.fm/news/world-news/us-military-hackers-conducting-offensive-operations-in-support-of-ukraine-says-head-of-cyber-command/

US military hackers have conducted offensive operations in support of
Ukraine, the head of US Cyber Command has told Sky News.

In an exclusive interview, General Paul Nakasone also explained how "hunt
forward" operations were allowing the United States to search out foreign
hackers and identify...

SideWinder Hackers Launched Over a 1, 000 Cyber Attacks Over the Past 2 Years Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/sidewinder-hackers-launched-over-1000.html

An "aggressive" advanced persistent threat (APT) group known as SideWinder
has been linked to over 1,000 new attacks since April 2020.

"Some of the main characteristics of this threat actor that make it stand
out among the others, are the sheer number, high frequency and persistence
of their attacks and the large collection of encrypted and obfuscated...

Hackers are Selling US University Credentials Online, FBI Says Matthew Wheeler (May 31)
https://tech.co/news/hackers-are-selling-us-university-credentials-online-fbi-says

The Federal Bureau of Investigation has warned US universities and colleges
that it has found banks of login credentials and other data relating to VPN
access circulating on cybercriminals forums.

The fear is that such data will be sold and subsequently used by malicious
actors to orchestrate attacks on other accounts owned by the same students,
in the hope...

Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/interpol-nabs-3-nigerian-scammers.html

Interpol on Monday announced the arrest of three suspected global scammers
in Nigeria for using remote access trojans (RATs) such as Agent Tesla to
facilitate malware-enabled cyber fraud.

"The men are thought to have used the RAT to reroute financial
transactions, stealing confidential online connection details from
corporate organizations, including oil and gas...

U.S. Warns Against North Korean Hackers Posing as IT Freelancers Matthew Wheeler (May 18)
https://thehackernews.com/2022/05/us-warns-against-north-korean-hackers.html

Highly skilled software and mobile app developers from the Democratic
People's Republic of Korea (DPRK) are posing as "non-DPRK nationals" in
hopes of landing freelance employment in an attempt to enable the regime's
malicious cyber intrusions.

That's according to a joint advisory from the U.S. Department of State, the
Department of the...

FBI and NSA say: Stop doing these 10 things that let the hackers in Matthew Wheeler (May 18)
https://www.zdnet.com/article/fbi-and-nsa-say-stop-doing-these-10-things-that-let-the-hackers-in/

Cyber attackers regularly exploit unpatched software vulnerabilities, but
they "routinely" target security misconfigurations for initial access, so
the US Cybersecurity and Infrastructure Security Agency (CISA) and its
peers have created a to-do list for defenders in today's heightened threat
environment.

CISA, the FBI and National...

Fifth of Businesses Say Cyber-Attack Nearly Broke Them Matthew Wheeler (May 18)
https://www.infosecurity-magazine.com/news/fifth-of-businesses-cyber-attack/

A fifth of US and European businesses have warned that a serious
cyber-attack nearly rendered them insolvent, with most (87%) viewing
compromise as a bigger threat than an economic downturn, according to
Hiscox.

The insurer polled over 5000 businesses in the US, UK, Ireland, France,
Spain, Germany, the Netherlands and Belgium to compile its annual Hiscox
Cyber...

Hacker And Ransomware Designer Charged For Use And Sale Of Ransomware, And Profit Sharing Arrangements With Cybercriminals Matthew Wheeler (May 18)
https://www.shorenewsnetwork.com/2022/05/16/hacker-and-ransomware-designer-charged-for-use-and-sale-of-ransomware-and-profit-sharing-arrangements-with-cybercriminals/

A criminal complaint was unsealed today in federal court in Brooklyn, New
York, charging Moises Luis Zagala Gonzalez (Zagala), also known as
“Nosophoros,” “Aesculapius” and “Nebuchadnezzar,” a citizen of France and
Venezuela who resides in Venezuela, with attempted...

State of Ransomware shows huge growth in threat and impacts Matthew Wheeler (May 04)
https://www.continuitycentral.com/index.php/news/technology/7275-state-of-ransomware-shows-huge-growth-in-threat-and-impacts

Sophos has released its annual survey and review of real-world ransomware
experiences in its ‘State of Ransomware 2022’ report. This shows that 66
percent of organizations surveyed were hit with ransomware in 2021, up from
37 percent in 2020.

The average ransom paid by organizations that had data encrypted in their...

Metasploit — Development discussion for Metasploit, the premier open source remote exploitation tool

• Archived Posts
• RSS Feed
• About List

Wireshark — Discussion of the free and open source Wireshark network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.

• Archived Posts
• RSS Feed
• About List

Snort — Everyone's favorite open source IDS, Snort. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• snortLatest Posts

Snort Subscriber Rules Update 2025-05-29 Research via Snort-sigs (May 29)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-05-27 Research via Snort-sigs (May 27)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-office,
file-other, protocol-other and server-webapp rule sets to provide
coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Request for Documentation on Snort's Capabilities in Detecting/Preventing Covert Malware Communications Jerwill via Snort-sigs (May 16)
Dear Snort Users,

I am writing as a subscriber and user of Snort to respectfully request assistance in obtaining at least one official
documentation or reference material that details how Snort is capable of detecting and/or preventing covert malware
communications across various channels.

Our organization is currently undergoing a compliance audit, and this documentation is critical in demonstrating our
capabilities in network-based threat...

Snort Subscriber Rules Update 2025-05-15 Research via Snort-sigs (May 15)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-other,
malware-cnc, malware-other, policy-other, protocol-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-05-13 Research via Snort-sigs (May 13)
Talos Snort Subscriber Rules Update

Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.

Details:
Microsoft Vulnerability CVE-2025-24063:
A coding deficiency exists in Microsoft Kernel Streaming Service Driver
that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with:
Snort 2: GID 1, SID 1:64848, 1:64849,
Snort...

Snort Subscriber Rules Update 2025-05-08 Research via Snort-sigs (May 08)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the os-other,
os-windows, policy-other and server-webapp rule sets to provide
coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-05-06 Research via Snort-sigs (May 06)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the os-other,
policy-other and server-webapp rule sets to provide coverage for
emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-05-01 Research via Snort-sigs (May 01)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the os-windows and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

IPFirewall and paid Subscripion Rules KMPollock via Snort-sigs (Apr 30)
I have Personal Subscription - Paid

I have a current Registration OinkCode (from before the Subscription)

if I supply the Registered Oinkcode inside IPFire’s Talos Registered field, will IPFire still pull only the delayed
Registered rules,

not the fresher Subscription rules?

Currently I have manually installed the Personal Subscription Rules, 

  KMPollock

| KMPollock () pm me  | 📞 +1 (605) 981-3791  ——  +1 (404) 410-1733 ...

Snort Subscriber Rules Update 2025-04-29 Research via Snort-sigs (Apr 29)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the indicator-scan,
malware-cnc and server-webapp rule sets to provide coverage for
emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-04-24 Research via Snort-sigs (Apr 24)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-multimedia,
file-other, indicator-compromise and server-webapp rule sets to provide
coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

PROTOCOL-VOI Rich Lane via Snort-sigs (Apr 22)
Help! How do i get all 400+ PROTOCOL-VOIP signatures? I only see seven when I download the community rules from Snort.

Thanks,

Rich

Snort Subscriber Rules Update 2025-04-22 Research via Snort-sigs (Apr 22)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the app-detect,
file-pdf, malware-cnc, malware-other, policy-other and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-04-18 Research via Snort-sigs (Apr 18)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-other
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2025-04-17 Research via Snort-sigs (Apr 17)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the exploit-kit,
file-pdf, malware-other, os-windows and server-webapp rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories