Malicious commits made to PHP project on git.php.net to allow RCE, project moved to github.com Security News & Discussion

---

• Malicious commits made to PHP project on git.php.net to allow RCE, project moved to github.com
• “netmask” npm package, used by 270,000+ projects, vulnerable to octal input data: server-side request forgery, remote file inclusion, local file inclusion, and more (CVE-2021-28918)
• SAML XML Injection - a class of vulnerability that could allow an attacker to modify SAML responses generated by an Identity Provider, and thereby gain unauthorized access to arbitrary user accounts or to escalate privileges
• Poking At Elasticsearch: Beyond Just Dumping Data
• Sodinokibi (aka REvil) Ransomware DFIR Report
• Old but Gold - Attack and Defend the Sys Admins
• Exfil data from RDP using Num,Cap, and Scroll lock keys
• Bootstrap Fail - Persistent XSS via Opportunistic Domain Sniping

Malicious commits made to PHP project on git.php.net to allow RCE, project moved to github.com Posted: 29 Mar 2021 01:10 AM PDT submitted by /u/queensgetdamoney [link] [comments]

“netmask” npm package, used by 270,000+ projects, vulnerable to octal input data: server-side request forgery, remote file inclusion, local file inclusion, and more (CVE-2021-28918) Posted: 28 Mar 2021 12:54 PM PDT submitted by /u/docker-osx [link] [comments]

SAML XML Injection - a class of vulnerability that could allow an attacker to modify SAML responses generated by an Identity Provider, and thereby gain unauthorized access to arbitrary user accounts or to escalate privileges Posted: 29 Mar 2021 09:21 AM PDT submitted by /u/digicat [link] [comments]

Poking At Elasticsearch: Beyond Just Dumping Data Posted: 29 Mar 2021 04:55 AM PDT submitted by /u/DLLCoolJ [link] [comments]

Sodinokibi (aka REvil) Ransomware DFIR Report Posted: 28 Mar 2021 11:58 PM PDT submitted by /u/digicat [link] [comments]

Old but Gold - Attack and Defend the Sys Admins Posted: 28 Mar 2021 05:24 PM PDT submitted by /u/ZephrX112 [link] [comments]

Exfil data from RDP using Num,Cap, and Scroll lock keys Posted: 26 Mar 2021 09:03 PM PDT submitted by /u/INIT_6 [link] [comments]

Bootstrap Fail - Persistent XSS via Opportunistic Domain Sniping Posted: 26 Mar 2021 03:33 PM PDT submitted by /u/drstarskymrhutch [link] [comments]

You are subscribed to email updates from /r/netsec - Information Security News & Discussion. To stop receiving these emails, you may unsubscribe now.	Email delivery powered by Google
Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States