Resource Center
Welcome to our cybersecurity resource center where we uncover how malicious actors exploit weaknesses in systems, while going beyond the technical aspects and examining real-world perspectives across various industries.
Filters
Showing 475–480 of 481 results
CVE-2021-27927: CSRF to RCE Chain in Zabbix
Zabbix is an enterprise IT network and application monitoring solution. In a routine review of its source code, we discovered a CSRF (cross-site request forgery) vulnerability in the authentication component of the Zabbix UI. Using this vulnerability, an unauthenticated attacker can take over the Zabbix administrator's account if the attacker can persuade the Zabbix administrator to follow a malicious link....
Read More 
POC CVE-2021-21972
Write the file supplied in the --file argument to the location specified in the --path argument. The file will be written in the context of the vsphere-ui user. If the target is vulnerable, but the exploit fails, it is likely that the vsphere-ui user does not have permissions to write to the specified path.
Read More 
Coming Changes in the Security Landscape
I’m sharing this because I believe it is relevant to ongoing decisions in this community. I’m in a senior leader cyber group and got the chance to follow the headliner yesterday on Vulnerability Assessment tools. I lit them up, and had a CEO reach out to me afterwords on LI…here’s the conversation: Hi Monti, Thank you for your thoughts on...
Read More 
Purple Teams
Purple teaming is the result of collaboration, communication and sharing of information between a red team and a blue team in an effort to improve the overall security posture of an organization. How organizations comprise these components may vary, but for context, a Red team is the offensive security team. They are trained in the tools, Tactics, Techniques and Procedures...
Read More CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
LibreNMS is an open source solution for network monitoring based on PHP, MySQL and SNMP. While reviewing its source code, we discovered a second-order SQL injection vulnerability, CVE-2020-35700, in the Dashboard feature. This vulnerability is exploitable by any authenticated user inside LibreNMS. The vulnerability is fixed in LibreNMS 21.1.0.
Read More Unauthenticated XSS to Remote Code Execution Chain in Mautic < 3.2.4
Mautic is widely used open source software for marketing automation. While researching the application and its source code on Github, we discovered an attack chain whereby an unauthenticated attacker could gain remote code execution privileges on the server hosting Mautic by abusing a stored XSS vulnerability. The issues raised in this post, CVE-2020-35124 and CVE-2020-35125, have been fixed in Mautic...
Read More