Axel Rengstorf

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

Anatomy Lesson from the Perspective of a Pentester - Guest Lecture at Johannes Gutenberg University Mainz 🎓 Our colleague Matthias Göhring was once again invited to give a guest lecture at Johannes Gutenberg-Universität Mainz. This time, the topic was “Professional Penetration Testing”. The question arose: What characterizes a good #PenetrationTest and how should it be structured? The lecture also covered topics such as the different types of technical security analyses and the management of #vulnerabilities. Thank you very much for the great event. We look forward to the next one! 📰👉 https://lnkd.in/eTbXTyRi #Pentesting #CyberSecurity #JGUMainz #moresecurity

2

🚨 Security Advisory: Important CVEs Disclosed 🚨 Hi Envoy Community, We would like to inform you about the following Common Vulnerabilities and Exposures (CVEs) identified in Envoy: 🔒 CVE-2024-45807: oghttp2 crash on OnBeginHeadersForStream 🔒 CVE-2024-45808: Malicious log injection via access logs 🔒 CVE-2024-45806: Potential manipulation of x-envoy headers from external sources 🔒 CVE-2024-45809: JWT filter crash in the clear route cache with remote JWKs 🔒 CVE-2024-45810: Envoy crashes for LocalReply in HTTP async client 🔧 Resolutions Coming Soon: These issues will be addressed in the following Envoy releases: - v1.31.2 - v1.30.6 - v1.29.9 - v1.28.7 🔗 Release Information: The updates will be available on our Releases Page starting today. 📖 Documentation: For detailed guidance, please refer to our Envoy Documentation. 🔄 Upgrade Recommendation: We strongly encourage all users to update to the latest versions of Envoy to ensure security and stability. 🔍 Ongoing Improvements: A pull request addressing these vulnerabilities has been initiated on the main branch. Thank you for your attention and continued support. ♻ REPOST this to help other Envoy users stay on top of Envoy News. #EnvoyProxy #Kubernetes #Security #CVE #DevOps #CloudNative #OpenSource #CyberSecurity

6

Finding security vulnerabilities in TLS-Libraries automatically using TLS-Anvil. Check out our new german article in the "IT-SICHERHEIT magazine" or on our cybersecurity blog.  🌐 Hackmanit Blog https://lnkd.in/eYW-VN4E ✅ German magazine article by IT-SICHERHEIT https://lnkd.in/ea-yU_eE 🛠️ TLS-Anvil https://tls-anvil.com/ 🔑 KoTeBi https://www.kotebi.de/en/ #TLS #itsecurity #itsicherheit #cybersicherheit #cybersecurity

3

🛡️ The best defense (for devs) is a strong offense (mindset)! 🛡️ Want to code more secure apps? Think like a hacker. Find out how to better anticipate, prevent, and mitigate potential security threats at #codetalks24 with Matthias Held, #CISO at Bugscrowd. Whether you’re a developer, tech lead, or security specialist, learn how to view your app through the eyes of an attacker—and protect it in the process. 🔓 Join Matthias to: 🚨 Simulate real-world attacks on your systems and applications 🕵️‍♀️ Explore case studies on common security pitfalls and successful hacks 🧩 Discover frameworks for threat modeling ✍️ Get practical tips for integrating security into your code review process 👥 Build a culture of security awareness within your development team This talk will transform how you think about coding and security, making secure coding practices a natural part of your development process. Join us at #codetalks24 (19-20 September)

26

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-4890 A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14. CVSSv3.1 Base Score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #litellm #apisecurity #owasp https://lnkd.in/d8eyE_uh

3

🔥 High risk vulnerability detected in Cilium! 🚨 The issue lies in CIDR deny policies not taking effect when a more narrow CIDR allow is present. This could lead to unauthorized access. CVE number is pending. The issue has been patched in Cilium v1.14.16 and v1.15.10. Stay safe and update your systems! #Cilium #Vulnerability #OWASP #API #Security https://lnkd.in/evTk5Bgm

1

⚠️Low Risk Vulnerability Alert⚠️: CVE-2024-5812 A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request. CVSSv3.1 Base Score: 3.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) https://lnkd.in/dR9W5CrQ

5

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-35182 Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function. CVSSv3.1 Base Score: 5.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #meshery #apisecurity #owasp https://lnkd.in/dHsGMKms

7

#AI is the double-edged sword in #cybersecurity ⚔️ What happens when this innovation becomes a vulnerability? Jasmin Landry, Security Researcher and HackerOne Pentester put it together quite nicely (check out the quote in the post ⬇️) Two key fronts to consider here: 1️⃣ Security for AI: managing the risks that come with AI deployments. 2️⃣ AI for Security: leveraging AI to detect and manage vulnerabilities faster than ever before. But here’s the kicker: even with cutting-edge AI tools, human expertise is still critical to ensuring trustworthy, secure innovation. In our recent deep dive into AI and vulnerability management, we highlight how security teams are adapting to stay ahead of threats—and what it means for the future. 💬 What’s your take?

8

Interested in some FREE video content? Here is a video about Execution Policy Bypassing Techniques | PowerShell and Windows for Red Teamers | PenTest Magazine https://lnkd.in/d3rQ29Hm #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

2

Interested in some FREE video content? Here is a video about Execution Policy Bypassing Techniques | PowerShell and Windows for Red Teamers | PenTest Magazine https://lnkd.in/d3rQ29Hm #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

6

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-35181 Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue. CVSSv3.1 Base Score: 5.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #meshery #apisecurity #owasp https://lnkd.in/dwTPQ9vT

7

CVE-2017-7938 - CVSS 9.8 - EPSS 1,24% - Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files. Ref.: https://lnkd.in/ea26bBra

1