ROSECURIFY
Subscribe
~/ seclog/ #148

Seclog - #148

43 curated links

g3n3r4l30

  1. KDE End-of-Year Fundraiser Celebration (kde.org)

    KDE celebrates its birthday with a year-end fundraiser campaign, highlighting community support for the open-source project. KDE

  2. Go's Traversal-Resistant File APIs (go.dev)

    The Go programming language introduces new traversal-resistant file APIs to enhance security by mitigating directory traversal vulnerabilities. Go

  3. Introducing DASVS: Desktop Application Security Standard (afine.com)

    AFINE has introduced the Desktop Application Security Standard (DASVS). This new standard provides comprehensive guidelines for digitally securing desktop applications. afine.com

  4. LOOBins Security Tool Resource (loobins.io)

    LOOBins provides information on living-off-the-land binaries and scripts for security testing and red teaming.

  5. Apple Security Bounty Program Evolution (security.apple.com)

    Apple announces a major evolution of its Security Bounty program, offering top awards for the most advanced research.

  6. Checkmk Path Traversal Vulnerability Disclosed (seclists.org)

    A full disclosure advisory details CVE-2025-39664, a path traversal vulnerability in Checkmk. This security flaw, identified as SBA-ADV-20250730-01, poses a risk of unauthorized access.

  7. Critical Adobe Experience Manager Bugs (slcyber.io)

    Assetnote security research details finding critical vulnerabilities in Adobe Experience Manager, emphasizing common pitfalls.

  8. Hacking ClubWPT Gold Back Office (samcurry.net)

    Sam Curry exposes vulnerabilities in the World Poker Tour's ClubWPT Gold back office system, revealing security flaws.

  9. Frida 17.4.0 Release Announcement (frida.re)

    Frida 17.4.0 released with new features and improvements for dynamic instrumentation on various platforms.

  10. PolarEdge Backdoor Analysis for QNAP (blog.sekoia.io)

    Analysis of the PolarEdge backdoor used in QNAP devices, referencing CVE-2023-20118 and its capabilities.

  11. Bypassing WAFs with Oversized Requests (blackhillsinfosec.com)

    This article explores techniques for bypassing WAFs (Web Application Firewalls) by utilizing oversized requests. It delves into both application and cloud-based attack vectors.

  12. Zscaler Advisory on F5 Security Incident (zscaler.com)

    Zscaler provides an advisory on the recent F5 security incident, offering recommendations and details.

  13. WatchGuard Fireware OS IKEv2 Out-of-Bounds Write (labs.watchtowr.com)

    WatchTowr Labs discloses "yIKEs," an IKEv2 Out-of-Bounds Write vulnerability (CVE-2025-9242) affecting WatchGuard Fireware OS. The advisory provides technical details and impact analysis.

  14. SF2 Framework Security Testing Tool (sf2framework.com)

    SF2 framework provides tools for security testing and analysis, aiding in vulnerability assessment.

  15. Spring Cloud Gateway SPEL Vulnerability (blog.z3r.ru)

    CVE-2025-41243 in Spring Cloud Gateway involves complicated evaluation context leading to security issues.

  16. How Indonesia Broke Kotlin (sam-cooper.medium.com)

    Analysis of how Indonesia's regulations impacted Kotlin programming language usage and security implications.

  17. File Creation via SQLite Injection (muffsec.com)

    Exploitation technique for creating files through SQLite injection vulnerabilities, demonstrating code execution risks.

  18. Pixnapping Attack on Digital Images (pixnapping.com)

    Pixnapping attack exploits vulnerabilities in digital image processing, affecting integrity and security.

  19. CrowdStrike Blocks Git Vulnerability (crowdstrike.com)

    CrowdStrike Falcon prevents exploitation of CVE-2025-48384 in Git, highlighting endpoint protection efficacy.

  20. Email Bombs Target Zendesk Authentication (krebsonsecurity.com)

    Email bombs exploit lax authentication in Zendesk support platform, causing service disruption.

  21. WireTap Attack on Server SGX (wiretap.fail)

    WireTap breaks server SGX security via DRAM bus interposition, compromising confidential computing.

  22. Nearly Hacked by Fake Job Interview (blog.daviddodda.com)

    Personal account of almost being hacked through a fraudulent job interview process, emphasizing social engineering risks.

  23. F5 Security Incident Details (my.f5.com)

    F5 provides details on a recent security incident affecting their systems and response measures.

  24. Hacking Nokia Beacon Router with UART (spaceraccoon.dev)

    Exploiting UART, command injection, and password generation on Nokia Beacon 1 router using Qiling framework.

  25. Strapi Software Vulnerability Advisory (cert.pl)

    CERT PL discloses CVE-2025-3930, a vulnerability in Strapi software, urging updates.

  26. GitHub Copilot Vulnerability Leaks Code (legitsecurity.com)

    CamoLeak critical vulnerability in GitHub Copilot exposes private source code, raising data security concerns.

  27. Pwning Nix Ecosystem via Actions (ptrpa.ws)

    Abuse of Nixpkgs actions leads to compromising the entire Nix ecosystem, highlighting supply chain risks.

  28. Redis CVSS 10.0 Vulnerability Response (scotthelme.co.uk)

    CVE-2025-49844 in Redis with CVSS 10.0 and how the community responded to mitigate risks.

  29. Botnet Coordinated RDP Attacks on US (greynoise.io)

    100,000+ IP botnet launches coordinated RDP attack wave against US infrastructure, emphasizing threat landscape.

  30. Diffing 7-Zip for CVE-2025-11001 (pacbypass.github.io)

    Technical analysis through diffing to find CVE-2025-11001 in 7-Zip software, revealing patching methods.

X5

  1. Frida 17.4 with Simmy for Simulators (@fridadotre)

    Frida 17.4 introduces Simmy, a new backend for Apple's Simulators on macOS. This allows users to spawn, attach, and instrument apps on simulators just like on a real device. Watch Here

  2. Conti Target Alexey Kurashov Identified (@GangExposed_RU)

    GangExposed RU identifies Alexey Kurashov (BLOODRUSH) as a TARGET (CONTI) member, offering a $10M reward. Stylometry, travel, and chat data confirm his link to the CONTI core. Watch Here

  3. FuzzingLabs Accuses GeckoSec of CVE Theft (@FuzzingLabs)

    FuzzingLabs publicly accuses GeckoSec of stealing two CVEs found on Ollama and Gradio. They claim GeckoSec copied PoCs, claimed CVE IDs, and back-dated blog posts. Watch Here

  4. US Court Bans NSO from Hacking WhatsApp (@jsrailton)

    John Scott-Railton reports that a US court permanently bans Pegasus spyware maker NSO Group from hacking WhatsApp. NSO must delete exploits, a significant blow to the company and a win for WhatsApp. Watch Here

  5. X Post by Koryodynasty (@koryodynasty)

    An X post by koryodynasty is linked. Further details require viewing the post directly. Watch Here

y0utube3

  1. Mobile Networks: Old Bugs Never Die? (youtube.com)

    Dr. Altaf Shaik discusses "Unveiling the Ghosts of Mobile Networks," exploring how old bugs persist. This talk questions when these vulnerabilities will finally die out in mobile network infrastructures. Watch Here

  2. Episode 8: Mohammed Bagha "MB" (youtube.com)

    This YouTube video features Episode 8 of a series, focusing on Mohammed Bagha, also known as "MB." Viewers can watch the full discussion or interview here. Watch Here

  3. OWASP GenAI Security Project Insights (youtube.com)

    Steve Wilson discusses "Inside the OWASP GenAI Security Project" in ASW 352. This video provides valuable insights into securing generative AI applications. Watch Here

g1thub5

  1. Lenovo Driver PoC for System Shell (github.com)

    This GitHub repository contains a PoC for popping a system shell against the LnvMSRIO.sys driver. It demonstrates a vulnerability (CVE-2025-8061) affecting Lenovo systems. Explore on GitHub

  2. JADX Plugin for MCP Server Integration (github.com)

    This GitHub project introduces a plugin for JADX to integrate with an MCP server. It aims to enhance JADX functionality by connecting to the MCP server. Explore on GitHub

  3. SockTail GitHub Repository (github.com)

    The SockTail GitHub repository by Yeeb1 is available, with its readme file highlighted. It provides insights into the project's purpose and functionality. Explore on GitHub

  4. Archive of 0day.today Exploits (github.com)

    This GitHub repository, 0day.today.archive, by vulncheck-oss, serves as an archive of exploits previously found on 0day.today. It provides a historical collection of known vulnerabilities. Explore on GitHub

  5. Vulnerability Scoring Systems Repository (github.com)

    This GitHub repository, vulnerability-scoring-systems by patrickmgarrity, compiles information and resources on various methods for scoring vulnerabilities. It serves as a comprehensive reference. Explore on GitHub

← All Seclogs