2020-01-24 16:00 UTC
Security Journalism
Security Journalism
Validating the SolarWinds N-central 'Dumpster Diver' Vuln | Huntress
Read more about Huntress validating the SolarWinds N-central “Dumpster Diver” Vulnerability.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 1,388 matching records.
AUTO-POLL // 2026-10-06 03:25 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
NO DATA
NO INTELLIGENCE AGGREGATED TODAY
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 6
NO DATA
--
NO INTEL
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
WED
Sep 30
RANSOMWARE
P10
WARM // 59 ARTICLES
2019-11-29 00:00 UTC
Other
Other
Google Cloud Platform VRP Prize Writeup
A vulnerability was discovered in Google Cloud Platform's AI Hub service, allowing unrestricted file uploads. This could potentially lead to bypassing Same-Origin Policy by uploading SWF files, enabling CSRF attacks across browsers, and exploiting CVE-2014-8453 on IE with Adobe Reader installed. The issue resulted in a $1337 bounty reward.
P5
2019-08-31 00:00 UTC
Other
Other
Google App Engine RCE Worth $36k
Researcher discovered access to non-production Google App Engine environments and internal APIs. This allowed configuring internal settings like Service Account IDs and quotas. Google considered it RCE due to their infrastructure. Access was blocked and a $36,337 reward issued.
P15
2019-08-04 00:00 UTC
Other
Other
AWS IAM role credential exfiltration via EC2 Instance Metadata Service (IMDSv1)
AWS offers a metadata service accessible to most EC2 Instances via a simple GET request to 169.254.169.254. If an instance has an SSRF vulnerability, attackers can access the metadata service & exfiltrate the credentials of an attached IAM role to gain privileged access to the relevant AWS environment.
P0
2019-06-18 00:00 UTC
Other
Other
IAM privilege escalation via undocumented CodeStar API
The AWS CodeStar service had an undocumented API (codestar:CreateProjectFromTemplate) that allowed users with broadly-scoped CodeStar permissions to create a CodeStar project. As part of the creation process, AWS would create a new CodeStarWorker IAM policy & attach it to the user making the call. This policy granted full access to over 50 AWS services, including iam:AttachRolePolicy, iam:AttachUserPolicy and iam:PutRolePolicy permissions, which would allow the user to escalate to full administ…
P10
2019-02-08 14:00 UTC
Security Journalism
Security Journalism
CVE-2017-18362: SQL Injection in ManagedITSync Integration | Huntress
A vulnerability was discovered and disclosed in late 2017 that affected the ConnectWise ManagedITSync integration, designed to sync data between the ConnectWise Manage PSA and the Kaseya VSA RMM.
P5
2018-01-30 07:00 UTC
Security Journalism
Security Journalism
Deep Dive: Kaseya VSA Mining Payload
For many of us in the Managed Services Provider market, we were rocked with news of a vulnerability in Kaseya’s VSA product. The purpose of this blog is to shine technical light on what the Huntress ThreatOps team observed and analyzed thus far.
P0
2016-04-06 00:00 UTC
Security Journalism
Security Journalism
How My StubHub Account Got Hacked | Huntress
If you have a StubHub account, you are open to a major vulnerability of having your StubHub hacked. Learn more about how you are at risk & how Huntress' Security Awareness Training can help.
P0