>> ARCHIVE: 2022-05

Cryptolocker ransomware drops a PE file in the AppDataRoaming directory which then tries to load a DLL named “netapi32.dll”. Therefore, we can drop our own DLL to intercept and terminate…

Radamant ransomware tries to load a DLL named “PROPSYS.dll” and execute a hidden PE file “DirectX.exe” from the AppDataRoaming directory. Therefore, we can drop our own DLL to intercept and…

Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to…

Red Planet Laundry Management System version 1.0 suffers from a remote SQL injection vulnerability.

SAP Web Dispatcher suffers from an HTTP request smuggling vulnerability.

PHProjekt PhpSimplyGest and MyProjects version 1.3.0 suffer from a cross site scripting vulnerability.

This Metasploit module exploits an arbitrary file write in the debug log file option chained with a path traversal in the language settings that leads to remote code execution in…

This Metasploit module exploits an arbitrary file write in the debug log file option chained with a path traversal in the language settings that leads to remote code execution in…

Conti ransomware looks for and loads a DLL named “wow64log.dll” in WindowsSystem32. Therefore, we can drop our own DLL to intercept and terminate the malware pre-encryption. The exploit DLL will…