2023-12-20 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A critical vulnerability in GitHub's actions/runner-images repository allowed arbitrary code execution on self-hosted runners, potentially enabling modification of GitHub's runner base images. The flaw stemmed from misconfigured self-hosted runners on a public repository with default workflow approval settings. The researcher gained persistence, accessed secrets, and could have inserted malicious code into GitHub's runner images used by customers.
P10
2023-12-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens. Identity Center relies on the jti claim in the third-party tokens to prevent replay attacks. Identity Center maintained a cache of previously-seen jti values for a fixed period (24 hours) and didn’t enforce that the third-party tokens had expiry claims. This meant that a token with a jti claim and without an exp claim could be replayed after >24 hours had passed.
P0
2023-12-15 07:56 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Cybersecurity essentials that ensure your business stays undisrupted in the upcoming year.
P0
2023-12-15 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A vulnerability in Google OAuth allows employees to retain indefinite access to applications like Slack and Zoom after being removed from their company's Google organization. The issue stems from the ability to create Google accounts using corporate email aliases, which can't be off-boarded by the organization. This bypasses typical account removal processes and poses a significant security risk.
P0
2023-12-14 06:02 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region
P0
2023-12-14 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress analysts recently observed a novel set of tactics, techniques, and procedures used by a threat actor for data collection and exfiltration.
P0
2023-12-13 00:00 UTC
Government
CERT-FR Alerts · indexed 2026-09-07 17:35 UTC
Le 4 décembre 2023, Apache a publié un avis de sécurité concernant la vulnérabilité critique CVE-2023-50164 concernant le cadriciel Struts 2. Cette vulnérabilité permet à un attaquant non authentifié de téléverser une porte dérobée sur un serveur vulnérable, et ainsi exécuter du code arbitraire à...
P5
2023-12-12 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A way to manage Azure OpenAI deployments via the Data Plane was discovered, bypassing key security controls. This allows creation/modification/deletion of deployments without the usual protections of Resource Manager Locks, Azure Policy, and Entra ID authentication.
P0
2023-12-12 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Discover how to streamline small business intelligence for practical decision-making, balance benefits, and explore cost-effective outsourcing solutions.
P0
2023-12-08 06:57 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Cybersecurity essentials that will ensure your business stays undisrupted in the upcoming year.
P0
2023-12-07 05:56 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used in attacks against Thai companies.
P0
2023-12-07 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Discover how leveraging technical indicators can boost cybersecurity effectiveness and empower small business defense. Read on for practical insights.
P0
2023-12-06 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
An update on our MDR for Microsoft 365 product, some recent improvements, and what fixes and features are coming soon.
P0
2023-12-04 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Learn more about how Huntress' Managed Security Awareness Program can help your employees follow CIS control requirements.
P0
2023-11-30 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Unit 42 researchers discovered a security risk in Google Workspace's domain-wide delegation feature that allows a GCP identity with necessary permissions to generate access tokens to impersonate Google Workspace users and access their data. This mismatch between GCP permissions and Google Workspace access could be exploited by malicious insiders or attackers with stolen credentials.
P0
2023-11-30 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
A look inside the evolving landscape of macOS malware. Dive into the current state of macOS threats and learn from a glossary of essential macOS terms.
P0
2023-11-29 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Dive into our analysis of the CVE-2023-43117 threat in CrushFTP and the growing popularity of MFT application exploitation as a tactic for adversaries.
P5
2023-11-28 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Threat actors frequently make use of native utilities during incidents. However, this blog post discusses a rarely-observed means of data exfiltration.
P0
2023-11-22 11:20 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
P0
2023-11-21 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Navigate the SMB threat landscape with Huntress’ SMB Threat Report. Gain insights into evolving cyber threats targeting SMBs. Read on for key insights.
P0
2023-11-16 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A vulnerability in Azure Function Apps allowed extraction of Managed Identity credentials from the encrypted startup context of Linux containers. This gave attackers with container access the ability to persist as the Managed Identity, breaking the intended security model. Microsoft has since patched the issue by encrypting the sensitive payload.
P0
2023-11-14 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Azure CLI commands were found to leak sensitive information, including credentials, through GitHub Actions logs. The vulnerability affects multiple Azure CLI commands and could expose secrets in public and private repositories. Microsoft has issued updates to Azure CLI, Azure Pipelines, and GitHub Actions to address the issue.
P0
2023-11-14 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Palo Alto discovered that Azure CLI commands were found to leak sensitive credentials and environment variables in GitHub Actions logs. This issue affects both public and private repositories, potentially exposing secrets to unauthorized parties. The problem stems from the Azure CLI's design to echo back accessed/created/updated/deleted resource information, which can include sensitive data. Later research by Orca Security revealed that AWS CLI and Google Cloud CLI were affected by the same iss…
P0
2023-11-10 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress has analyzed the emerging SysAid CVE-2023-47246 vulnerability and recreated the attack chain with a proof-of-concept exploit.
P15
2023-11-09 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress has uncovered a series of unauthorized access, revealing a threat actor using ScreenConnect to infiltrate multiple healthcare organizations.
P0
2023-11-08 07:59 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Take a deep dive into the operations of one of the most active players in the Ransomware-as-a-Service market.
P15
2023-11-08 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
SafeBreach Labs researchers developed methods to leverage Microsoft Azure's Automation Service for free, undetectable cryptocurrency mining. They found three ways to execute miners: two using their own environment and Azure's resources for free, and one in a victim's environment undetected. The techniques could potentially be used for any task requiring code execution on Azure.
P0
2023-11-07 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
CVE-2023-22518 is being exploited in Confluence for Cerber ransomware deployment. Read up on Huntress’ observations and mitigation guidance.
P20
2023-11-06 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
AppFlow had an undocumented service called sandstoneconfigurationservicelambda. An undocumented field (awsOwnedManagedAppCredentialsArn) could be used during connector registration and connector updates. Specifying a victim's Secret ARN as that field disclosed the clientId and clientSecret, so long as the victim Secret ARN belonged to a connection profile which is of the type OAuth or contains clientId and clientSecret.
P0
2023-11-06 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
The AppFlow WooCommerce connector allowed specification of a full URL. The connector included details of response content when the URL offered an unexpected response. This means you could make arbitrary GET requests to any URL from the WooCommerce connector, and view the response content. The response in the error was truncated to 500 characters.
P0
