Posts
2356Following
532Followers
1244Heretek of Silent Signal
buherator
buherator
https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/
0
0
0
repeated
Binary Ninja 
binaryninja@infosec.exchange
There is a known issue in the latest stable 4.1.5902 we wanted to make folks aware of. If you save a bndb while debugging, the database can get into an improper state and it may appear to lose user changes. The issue is resolved in the latest dev builds.
For those who are using the latest stable, you can either switch to dev or avoid saving during debugging (saving after debugging is unaffected). Impacted users can contact support (https://binary.ninja/support/) or see: https://github.com/Vector35/debugger/issues/612
0
2
0
repeated
Not Simon 🐐
screaminggoat@infosec.exchangewatchTowr: Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
Reference: CVE-2024-40711 (9.8 critical, disclosed 04 September 2024 by Veeam) Veeam Backup & Replication: A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). This vulnerability was reported by reported by Florian Hauser @frycos with CODE WHITE Gmbh @codewhitesec.
watchTowr doing what they do best, root cause analysis of vulnerabilities and breaking it down Barney style. Veeam Backup and Replication's CVE-2024-40711 has an authenticated RCE with a 9.8? watchTowr does patch-diffing (a lot of code and rambling). They name drop James Forshaw @tiraniddo in referencing “Stupid is as Stupid Does When It Comes to .NET Remoting”
Okay in reading through this, CVE-2024-40711 is actually comprised of two separate bugs. Veeam silently patched an improper authorization bug, then the deserialisation bug 3 months later. watchTowr claims that there is a way to bypass CVE-2024-40711 (details are still under embargo). They do not release a proof of concept due to the current situation and proclivity for ransomware actors to go after Veeam backups.
#cve_2024_40711 #vulnerability #rootcauseanalysis #cve #veeam #infosec #cybersecurity
0
3
0
repeated
Zig Weekly
zig_discussions@mastodon.socialData-Oriented Design Revisited: Type Safety in the Zig Compiler
https://www.youtube.com/watch?v=KOZcJwGdQok
Discussions: https://discu.eu/q/https://www.youtube.com/watch?v=KOZcJwGdQok
0
2
0
repeated
Cedric Halbronn
saidelike@infosec.exchange3 more weeks before my Windows Kernel Exploitation training at #HEXACON2024
Don't miss out! More info on contents -> https://www.hexacon.fr/trainer/halbronn/
0
2
0
repeated
Project Zero Bot
p0botPowerVR: DEVMEMXINT_RESERVATION::ppsPMR references PMRs but does not lock their physical addresses
https://project-zero.issues.chromium.org/issues/42451698
CVE-2024-34747
0
2
0
buherator
buheratorhttps://github.com/google/security-research/security/advisories/GHSA-3658-w6j3-w42r
0
1
2
buherator
buheratorhttps://3sjay.github.io/2024/09/08/Windows-Kernel-Pool-Exploitation-CVE-2021-31956-Part1.html?s=09
0
0
3
buherator
buheratorhttps://www.thezdi.com/blog/2024/9/4/exploiting-exchange-powershell-after-proxynotshell-part-1-multivaluedproperty
0
0
1
buherator
buheratorhttps://binarygecko.com/race-conditions-in-linux-kernel-perf-events/
0
1
4
buherator
buheratorhttps://blog.trailofbits.com/2024/09/06/unstripping-binaries-restoring-debugging-information-in-gdb-with-pwndbg/
0
5
5
buherator
buheratorhttps://arxiv.org/abs/2409.01841
0
0
1
repeated
Marco Ivaldi
raptor@infosec.exchange
2
3
1
buherator
buheratorhttps://en.wikipedia.org/wiki/Boyce%E2%80%93Codd_normal_form
0
0
0
repeated
Mythology Monday ✨
mythologymonday@thefolklore.cafeGreetings, Myth Lovers! In celebration of #BeerLoversDay Monday's theme is beer an other inebriating beverages! Do you know a myth that features beer or a similar drink? Is the beer helpful or a hindrance? Tell us the myth and use the hashtag #MythologyMonday for boosts.
#mythology @mythology @folklore @TarkabarkaHolgy @juergen_hubert @curiousordinary @wihtlore @FairytalesFood @bevanthomas @FinnFolklorist @Godyssey @GaymerGeek @starrytimepod @ljwrites
0
3
0
repeated
Sometimes when people don't want an idea interrogated they arrange words around it like a moat. Construct intricate vocabularies that make it so you can only approach it from certain directions, never from the directions where it is weak to attack. Insist you use their vocabulary, debate on their terms. Sometimes I like to just walk directly into the moat. See, it's only ankle deep. This makes people upset. You're ignorant of the theory! No, I'm standing in the middle of it. It's just water dude
6
5
0
repeated
Jeremi M Gosney 
epixoip@infosec.exchange
Team #Hashcat is pleased to present our much anticipated write-up for this year's #CrackMeIfYouCan contest at #Defcon32
#password #passwordcracking #redteam #ctf #defcon #hacking #infosec #cybersecurity
0
4
0
repeated
repeated
technomancy (turbonerd aspect)
technomancy@hey.hagelb.orgublock origin is great and so don't take this the wrong way but I've never understood why it doesn't have a they-live mode where instead of removing the ads altogether they get rendered as greyscale messages like "OBEY" / "CONSUME" / "DO NOT QUESTION AUTHORITY"
1
8
1