2023-04-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Asset Key Thief was a Google Cloud privilege escalation vulnerability that enabled principals with the "Cloud Asset Viewer" role (or other roles with the `cloudasset.assets.searchAllResources` permission) on the Cloud Asset Inventory API, at the Project, Folder, or Organization level to view and exfiltrate any user-managed Service Account private key under a project within the same Google Cloud environment that had been created or rotated up to a maximum of 12 hours ago. Access to Service Accou…
P10
2023-04-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
ApsaraDB and AnalyticDB contained several vulnerabilities in their PostgreSQL offerings which ultimately allowed unauthorized access to other tenants' databases and the ability to perform a supply-chain attack on both services, which in turn would have allowed remote code execution (RCE) as well. Both services implemented multi-tenancy through a shared K8s cluster, but contained several bugs related to tenant isolation which an attacker could chain together to achieve the above impact. In Apsar…
P25
2023-04-18 07:56 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Group-IB analysts discovered the new MuddyWater infrastructure while researching the pro-state group’s use of the legitimate SimpleHelp tool.
P0
2023-04-13 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress is bringing the hunt to Australia and New Zealand! Hear from the Regional Director of Huntress ANZ what this expansion means.
P0
2023-04-11 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Your security tools are just as likely to be attacked as anything else. This blog dives into traitorware and how it's used to live off the land.
P0
2023-04-06 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress is SOC2, GDPR and CCPA Compliant. Read what this means for us—and for our partners.
P0
2023-04-04 17:24 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Group-IB uncovers a new stealthy ransomware strain
P15
2023-04-04 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
We're so excited to say we're now securing more than two million endpoints!
P0
2023-04-03 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
The API action ListObservabilityConfigurationsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the observability configuration for App Runner in the account.
P0
2023-04-03 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
The API action ListVpcConnectorsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the VPC configuration for App Runner in the account including the subnet ID, security group ID, and the VPC Connector ARN.
P0
2023-03-31 10:59 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
What is known about the 3CX supply chain incident and how to defend against it?
P0
2023-03-31 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
In this blog, we contextualize the events and talk about enabling defense from the 3CX compromise.
P0
2023-03-30 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Azure on-premises data gateway allows data transfer between an on-prem customer network and several Azure cloud services, and also enables a connected agent installed locally in an on-prem network to perform certain actions remotely. NetSPI discovered a deserialization issue in Microsoft Power Platform connectors that lead to RCE on several Azure backend servers that processed call backs from on-premises data gateways, effectively allowing unauthorized cross-tenant access.
P15
2023-03-30 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Legit Security found an RCE vulnerability in Azure Pipelines that could have allowed an attacker to gain complete control of variables and tasks by exploiting logging commands. This would have enabled them to execute malicious code in a context of a pipeline workflow, which would have granted them access to sensitive secrets such as cloud deployment keys, move laterally in the organization, and potentially initiate supply chain attacks. To exploit this vulnerability, an attacker would have need…
P15
2023-03-30 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
The 3CX VoIP Desktop Application has been compromised to deliver malware via legitimate 3CX updates. Huntress has been investigating this incident and working to validate and assess the current supply chain threat to the security community.
P0
2023-03-28 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
A survey of mid-sized businesses revealed common cybersecurity vulnerabilities. Learn what they are and how to improve your security posture in 2023.
P0
2023-03-23 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Undocumented APIs used by the Azure Function Apps Portal could have allowed an attacker with existing access to a Reader role on a Function App to escalate their privileges and gain write permissions through arbitrary file reads on Function App containers. For Windows containers, this would only grant an attacker the ability to extract ASP.NET encryption keys (the impact of which remains unclear), but for Linux containers it would have allowed an attacker to read environmental variables contain…
P25
2023-03-21 04:13 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Group-IB uncovers more than 2,400 scam job pages in ongoing campaign targeting users in Egypt, KSA, Algeria, and 10 other MEA countries.
P0
2023-03-21 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
In this blog, we dive into macOS notifications—and the intentional design behind them.
P0
2023-03-20 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
AWS Control Tower was not properly logging to CloudTrail when API calls failed due to a lack of permissions. This could have helped an adversary with existing access to a victim AWS environment avoid detection while enumerating privileges, since any unsuccessful API calls would not generate "access denied" log entries.
P0
2023-03-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Due to an exposed development endpoint, it was possible to bypass CloudTrail logging for both read and write API actions for the Service Catalog service. This could have enabled adversaries to alter Service Catalog resources undetected after gaining a foothold in a victim AWS environment.
P0
2023-03-17 14:22 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Microsoft Outlook Elevation of Privilege Vulnerability
P5
2023-03-17 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.
P30
2023-03-16 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Series of blog posts that share the breadth and depth of Huntress’ experience to assist others in reducing their attack surface, and inhibiting or even obviating cyber attacks.
P0
2023-03-14 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Azure Service Fabric Explorer (SFX) was affected by an XSS vulnerability that could have allowed a malicious script to be reflected off a web application. After a potential victim clicked on a crafted malicious URL, the attacker could remotely toggle the ‘Cluster’ Event Type setting under the Events tab. This could lead to unauthenticated remote code execution on a container hosted on a Service Fabric node.
P15
2023-03-13 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
We cover CVE-2023-27532, a vulnerability in the Veeam Backup & Replication component that allowed an unauthenticated user to retrieve host credentials.
P5
2023-03-08 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A vulnerability in GitHub Actions allows bypassing workflow settings using commits from forked repositories (rather than commits of the main action repo). This "imposter commits" issue can potentially introduce untrusted code into CI/CD pipelines, posing a risk to the security of the software supply chain. The vulnerability stems from GitHub's handling of forked repositories and how commits are shared between forks and parent repositories. A partial solution to this was GitHub prohibiting parti…
P0
2023-03-07 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
EDR is a baseline for security controls these days. Learn which questions to ask and answers to give when seeking buy-in to add or replace an EDR in your security stack.
P0
2023-03-06 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A vulnerability in GitHub's Repository Security Advisory feature allowed unauthorized users to access plaintext Codespace secrets of any organization, including GitHub itself. The issue stemmed from the new beta feature that allows external users to report vulnerabilities to public repositories, inadvertently granting access to sensitive organization-level secrets.
P0
2023-02-25 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
An attacker with elevated permissions in CodeBuild could leak the configured credentials for Github/Bitbucket. This was possible by configuring the http_proxy and https_proxy variables, which would allow you to capture the credentials via MITM.
P0
