Cybersecurity

Late at night, I was testing a proof-of-concept (PoC) exploit for CVE-2020-35489 (https://github/[.]com/gh202503/poc-cve-2020-35489) that I found on GitHub. The repository looked legitimate, and in my exhaustion, I skipped the usual precautions. I cloned the repository and ran the script without inspecting its contents.

the EUVD comes with a holistic approach and aims for ensuring a high level of interconnection of information sources. It does so by leveraging the open-source software Vulnerability-Lookup which enables a quick correlation of vulnerabilities from multiple known sources. ... Utilising the Common Security Advisory Framework (CSAF), a standardised format for vulnerability advisories, the EUVD supports automation in the processing, consumption, and distribution of security advisories.

"Our recommendation is to do what your antivirus software says especially in regards to this one (WinRing0) because again it's not a false positive; it's a true positive. This is a real potential vulnerability and if Windows quarantines WinRing0 we'd say let it happen.

The Global CVE (GCVE) allocation system is a new, decentralized approach to vulnerability identification and numbering, designed to improve flexibility, scalability, and autonomy for participating entities.

This is an utter failure of oversight in governance. And likely a misappropriation of government funds.

Comments

WASHINGTON, April 15 (Reuters) - The notorious internet messageboard 4chan has been hacked, according to posts circulating online, some of which said that a the hacker involved had revealed identifying details of the site's moderators to the public. The alleged hack first came to light when a defunct section of the site sprang back to life with the words "U GOT HACKED" emblazoned across the top, according to Wired magazine.

Funding is about to run out for the Common Vulnerabilities and Exposures (CVE) program – a system used by major companies like Microsoft, Google, Apple, Intel, and AMD to identify and track publicly disclosed cybersecurity vulnerabilities. The program helps engineers identify how bad an exploit is and how to prioritize applying patches or other mitigations.

Mod IPs and emails leaked

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called “Smishing Triad” mainly impersonated toll road operators and shipping companies. But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff.

The database company said its Oracle Cloud Infrastructure (OCI) was not involved in the breach. And at least one law firm seeking damages is already on the case.

This month, Microsoft has released patches addressing a total of 125 vulnerabilities. Among these, 11 are classified as critical, highlighting the potential for significant impact if exploited. Notably, one vulnerability is currently being exploited in the wild, underscoring the importance of timely updates. While no vulnerabilities were disclosed prior to this patch release, the comprehensive updates aim to fortify systems against a range of threats, including remote code execution and privilege escalation. Users are encouraged to apply these patches promptly to enhance their security posture.

Edit 2025-04-09 16:42Z - article was updated with a tenth package (Prettier - Code)