| Date | Title | Description |
| Sign up to see | Sign up to see | Sign up to see |
| Aug 1, 2024 | Уязвимости Laravel, технология Cookieless и Kerberos-лапша, или Рассказ о том, как мы IDS Bypass 5 решали | Вот и прошли два месяца с окончания Positive Hack Days Fest 2. Несмотря на то что он уже второй год как городской киберфестиваль, все привычные активности остались. Один из конкурсов — IDS Bypass — мы провели в юбилейный, пятый раз. Подводи... |
| May 8, 2024 | Трендовые уязвимости апреля: до пяти лет скрытой эксплуатации | Хабр, привет! Я Александр Леонов, ведущий эксперт лаборатории PT Expert Security Center. Мы с командой аналитиков Positive Technologies каждый месяц анализируем информацию об уязвимостях из баз и бюллетеней безопасности вендоров, социальных... |
| Feb 8, 2024 | Researchers say attackers are mass-exploiting new Ivanti VPN flaw | Hackers have begun mass exploiting a third vulnerability affecting Ivanti’s widely used enterprise VPN appliance, new public data shows.
Last week, Ivanti said it had discovered two new security flaws — tracked as CVE-2024-21888 and CVE-202... |
| Feb 6, 2024 | As if two Ivanti vulnerabilities under exploit weren’t bad enough, now there are 3 | Enlarge
Getty Images reader comments 11
Mass exploitation began over the weekend for yet another critical vulnerability in widely used VPN software sold by Ivanti, as hackers already targeting two previous vulnerabilities diversified, resea... |
| Jan 29, 2024 | Призыв писать компактное ПО, версия 2024 года (с примером кода) | Этот пост посвящён памяти Никлауса Вирта, первопроходца в сфере вычислительных наук, ушедшего от нас 1 января этого года. В 1995 году он написал важную статью A Plea for Lean Software, и в своём посте я постараюсь воспроизвести её почти три... |
| Oct 31, 2023 | Business is booming on the dark web -- what does this mean for cyber risk? | It's been another profitable year for the cybercriminal underworld. Once again, headlines have been regularly dominated by serious breaches such as the Royal Mail and Capita, whilst behind the scenes, criminal gangs have raked in huge ... |
| Mar 29, 2023 | Ransomware crooks are exploiting IBM file exchange bug with a 9.8 severity | Enlarge
Getty Images reader comments 9 with
Share this story
Share on Facebook
Share on Twitter
Share on Reddit
Threat actors are exploiting a critical vulnerability in an IBM file-exchange application in hacks that install ransomware on se... |
| Feb 15, 2023 | Health info for 1 million patients stolen using critical GoAnywhere vulnerability | Enlarge
Getty Images reader comments 40 with
Share this story
Share on Facebook
Share on Twitter
Share on Reddit
One of the biggest hospital chains in the US said hackers obtained protected health information for 1 million patients after ex... |
| Feb 15, 2023 | Ransomware gang uses new zero-day to steal data on 1 million patients | A prolific ransomware operation is back with old tricks — and new victims.
Community Health Systems (CHS), one of the largest healthcare providers in the United States with close to 80 hospitals in 16 states, confirmed this week that crimin... |
| May 12, 2022 | Zyxel silently patches command-injection vulnerability with 9.8 severity rating | Enlarge
Zyxel reader comments 30 with 17 posters participating, including story author
Share this story
Share on Facebook
Share on Twitter
Share on Reddit
Hardware manufacturer Zyxel quietly released an update fixing a critical vulnerabilit... |
| Mar 30, 2022 | North Korean threat actors target news outlets and fintechs with a Google Chrome vulnerability | Image: Sergey Nivens/Shutterstock
Threat actors from North Korea have been exploiting a vulnerability in Google Chrome to target certain users with remote code, particularly news outlets, software vendors and fintechs in the United States.
... |
| Jan 28, 2022 | Rapid7 : Metasploit weekly wrap-up | I'm sure you know what's coming, more Log4Shell
For those wondering when the Log4Shell remediation nightmare will end, I'm afraid I can't give you that. What I can give you, though, is a new Log4Shell module! With the ne... |
| Jan 19, 2022 | Open-Source Security: Getting to the Root of the Problem | The past few weeks have shown us the importance and wide reach of open-source security. In December 2021, public disclosure of the Log4Shell vulnerability in Log4j, an open-source logging library, caused a cascade of dependency analysis by ... |
| Jan 14, 2022 | Rapid7 : Metasploit Weekly Wrap-Up | Log4Shell goodness
Log4Shell made an unfortunate end to 2021 for many organizations, but it also makes for some great additions to Metasploit Framework. Contributors sempervictus, schierlm, righel, timwr and our very own Spencer McIntyre ha... |
| Jan 11, 2022 | CVE-2021-20038..42: SonicWall SMA 100 Multiple Vulnerabilities (FIXED) | Over the course of routine security research, Rapid7 researcher Jake Baines discovered and reported five vulnerabilities involving the SonicWall Secure Mobile Access (SMA) 100 series of devices, which includes SMA 200, 210, 400, 410, and 50... |
| Dec 15, 2021 | Rapid7 : The Everyperson's Guide to Log4Shell (CVE-2021-44228) | If you work in security, the chances are that you have spent the last several days urgently responding to the Log4Shell vulnerability (CVE-2021-44228), investigating where you have instances of Log4j in your environment, and questioning you... |
| Dec 14, 2021 | Rapid7 : Using InsightVM to Find Apache Log4j CVE-2021-44228 | There are many methods InsightVM can use to identify vulnerable software. Which method is best depends on the software and specific vulnerability in question, not to mention variability that comes into play with differing network topologies... |
| Dec 8, 2021 | Patch Now: Sonicwall Fixes Multiple Vulnerabilities in SMA 100 Devices | Summary
On December 7, 2021, SonicWall released a security advisory that includes patching guidance for five vulnerabilities in SonicWall SMA 100 series devices that were discovered by Rapid7 (including CVE-2021-20038 which is rated CVSSv3 ... |
| Nov 10, 2021 | CVE-2021-43287 Allows Pre-Authenticated Build Takeover of GoCD Pipelines | On October 26, 2021, open-source CI/CD solution GoCD released version 21.3.0, which included a fix for CVE-2021-43287, a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration... |
| Oct 8, 2021 | What's New in InsightVM: Q3 2021 in Review | In today's post, we're giving a rundown of new features and functionality launched in Q3 2021 for InsightVM and the Insight Platform. We hope you can begin to leverage these changes to drive success across your organization. Apple... |
| Aug 12, 2021 | Popular Attack Surfaces, August 2021: What You Need to Know | Whether you attended virtually, IRL, or not at all, Black Hat and DEF CON have officially wrapped, and security folks' brains are replete with fresh information on new (and some not-so-new) vulnerabilities and exploit chains. The '... |
| Apr 8, 2021 | RAPID7, INC.
Rapid7 : Attackers Targeting Fortinet Devices and SAP Applications | The following blog was co-authored by Caitlin Condon and Bob Rudis, also known (in his own words) as 'some caveman from Maine.'
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI published a jo... |
| Apr 8, 2021 | Rapid7 : Attackers Targeting Fortinet Devices and SAP Applications | The following blog was co-authored by Caitlin Condon and Bob Rudis, also known (in his own words) as 'some caveman from Maine.'
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI published a jo... |
| Apr 4, 2021 | RAPID7, INC.
Rapid7 : Metasploit Wrap-Up | Sprinkle on the Modules
The first quarter of 2021 has given us wave after wave of Exchange vulnerabilities, and while our awesome contributors helped us continue coverage with another Exchange module we were able to add to Metasploit, we al... |
| Mar 11, 2021 | Хакеры активно эксплуатируют RCE-уязвимость GitLab | Исследователи кибербезопасности предупреждают, что пропатченная уязвимость удаленного выполнения кода (RCE) в веб-интерфейсе GitLab по-прежнему активно эксплуатируется злоумышленниками, подвергая опасности большое число экземпляров сервиса.... |
| More woes for Ivanti as exploit activity rises | A security vulnerability discovered by Ivanti during a separate security investigation is being widely exploited in the wild, security researchers say.
While investigating and patching CVE-2023-46805 and CVE-2024-21887, Ivanti discovered a ... |
