Seclog - #83

g3n3r4l16

1. Unsaflok (unsaflok.com)

   Unsaflok is a series of serious security vulnerabilities in the Saflok brand of hotel locks.

2. Index of /ubuntu/ubuntu/ubuntu/ubuntu/.. (ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.ubuntu.archive.ubuntu.com)

   Directory listing of Ubuntu archives.

3. Global Microsoft Meltdown Tied to Bad Crowstrike Update (krebsonsecurity.com)

   Issues caused by a faulty Crowdstrike update.

4. How to pwn a billion dollar VC firm using inspect element (kibty.town)

   Exploit demonstration against a VC firm using inspect element.

5. Auditing GitLab: Public Gitlab Projects on Internal Networks (blackhillsinfosec.com)

   Assessing security of GitLab projects on internal networks.

6. Encoding Differentials: Why Charset Matters (sonarsource.com)

   Understanding the importance of character set encoding in security.

7. Uncoordinated Vulnerability Disclosure: The Continuing Issues with CVD (zerodayinitiative.com)

   Challenges associated with uncoordinated vulnerability disclosure.

8. XenForo <= 2.2.15 Cross-Site Request Forgery Vulnerability (karmainsecurity.com)

   Analysis of a CSRF vulnerability in XenForo.

9. Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent (blog.chebuya.com)

   SSRF vulnerability in Havoc C2 server.

10. Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer (0reg.dev)

    Remote Code Execution vulnerability in Evernote.

11. A Race to the Bottom - Database Transactions Undermining Your AppSec (blog.doyensec.com)

    Exploring how database transactions can undermine application security.

12. Intigriti XSS Challenge July 2024 — Finding a new DOMPurify bug (realansgar.dev)

    Discovering a new bug in DOMPurify through an XSS challenge.

13. How we share secrets at a fully-remote startup (getgrist.com)

    Methods for securely sharing secrets in a remote work environment.

14. SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts (wiz.io)

    SAP AI vulnerabilities that risk cloud environments.

15. Cloudflare Reports that Almost 7% of All Internet Traffic Is Malicious (schneier.com)

    Cloudflare's analysis on the volume of malicious internet traffic.

16. Free workshops from Ringzer0 Training (vimeo.com)

    Access free cybersecurity workshops. Watch Here

y0utube1

1. I Bought 25 Million Computer Viruses (youtube.com)

   A journey through the world of computer viruses. Watch Here

g1thub10

1. Automated CrowdStrike BSOD Workaround in Safe Mode using Group Policy (gist.github.com)

   Script to mitigate BSOD caused by CrowdStrike in Safe Mode.

2. senaykt/cloud-security-resources (github.com)

   A comprehensive list of cloud security resources. Explore on GitHub

3. ph03n1x13/dumpdino (github.com)

   A tool for dumping Dino game data. Explore on GitHub

4. taubyte/tau (github.com)

   Open source distributed Platform as a Service (PaaS). Explore on GitHub

5. CERT-Polska/mailgoose (github.com)

   Web application for checking SPF, DMARC, and DKIM configuration. Explore on GitHub

6. kevin-mizu/domloggerpp (github.com)

   A browser extension for monitoring and debugging JavaScript sinks. Explore on GitHub

7. timothee-chauvin/eyeballvul (github.com)

   Vulnerability detection benchmark based on CVEs in open-source repos. Explore on GitHub

8. hiddify/hiddify-next (github.com)

   Multi-platform auto-proxy client supporting various protocols. Explore on GitHub

9. tantosec/oneshell (github.com)

   Reverse shell listener and payload generator for Linux targets. Explore on GitHub

10. veggiedefender/open-and-shut (github.com)

    Type in Morse code by repeatedly slamming your laptop shut. Explore on GitHub