Last Week in Security (LWiS) - 2024-09-09
Windows heap overflow (@esj4y), Linux TCP UAF (@v4bel), Goffloader (@BouncyHat), Intune lat-movement (@h4wkst3r), browser attack detection (@mega_spl0it), and more!
Windows heap overflow (@esj4y), Linux TCP UAF (@v4bel), Goffloader (@BouncyHat), Intune lat-movement (@h4wkst3r), browser attack detection (@mega_spl0it), and more!
argv[0] tampering (@Wietze), Moodle eval() misuse (@RedTeamPT), ntoskrnl.exe PoC (@b1thvn_), 4x wappd exploits (@hyprdude), and more!
"USDoD" doxed, VEH research (@passthehashbrwn), Defender exclusions (@dazzyddos), CSS history leak (@TheXC3LL), Cobalt Strike DNS listeners (@VirtualAllocEx), and more!
DEF CON 32 Tools and Talks, Apache confusion (Orange Tsai), private TLDs (@N7WEra), UDL ๐ฃ (@Oddvarmoe), crash analysis (@patrickwardle), and more!
Specula (@Oddvarmoe + @freefirex2), ๐งต namecalling (@hasherezade), North Korean ๐ฐ๐ต agents, Llama 3.1 (@Meta), GraphSpy updates (@RedByte1337), and more!
REx (@br0k3ns0und), EV charger exploits (@ret2systems), CerealKiller (@two06), payload encoding (@MoritzLThomas), responder honeypot (@lawndoc), and more!
HavocC2 SSRF (@_chebuya), PDF rendering diffs (@d4d89704243), Windows phishing 0day (@_CPResearch_), 3x Sharepoint RCEs (@testanull), Dynamics 365 flaws (@frycos), Mythic 3.3 Beta (@its_a_feature_), and more!
๐ป Ghostscript exploit (@thomasrinsma), CSPT2CSRF (@maxenceschmitt), Puppet Forge pwn (@adnanthekhan), WhatsUp Gold RCE+privesc (@SinSinology), UDRL-less beacon (@naksyn), EDRPrison (@senzee1984), and more!
Chrome RCE (@mmolgtm), Windows LPE (@carrot_c4k3 + @tykawaii98), Xerox RCEs+LPE (@_mohemiv), and more!
Electron security (@khronokernel), snapshot fuzzing (@h0mbre_), macOS helpers LPE (@L0Psec), and more!