VK Integrated Systems (VKIS)’s Post

[CVE-2024-38494: HIGH] This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request. https://lnkd.in/g6CsKrS5

🔒 Secure Your Enterprise with Ekran System! 🔒 📌 Key Features: - Insider Threat Detection - User Session Recording - Privilege Management - Real-time Alerts - Comprehensive Reporting

[CVE-2024-10202: HIGH] Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands. https://lnkd.in/eRYwhgdH

July is gone, but thanks to Antisyphon Training, I have learned a little more about a wide range of topics: Incident management, Geospatial Intelligence(GEOINT), Safeguard CI/CD pipeline and Windows Forensic.

New update on CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect. 03/05/2024

Part 2: Remediation Options (Manual Intervention) Reboot the host. Ideally the host will automatically download the updated/reverted CrowdStrike channel file. - Note: For hosts with Bitlocker-encryption enabled, be sure that you know that hosts recovery key as you may get prompted to enter it after the reboot. If the host crashes again: - Boot Windows into Safe Mode or the Windows Recovery Environment - Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory - Locate the file matching “C-00000291*.sys”, and delete it. - Boot the host normally. Command Line: cd \windows\system32\drivers\crowdstrike del C-00000291*.sys shutdown /r Sources: https://lnkd.in/e_U9TFrD https://lnkd.in/ewgzA5Db

Golden Ticket Attack The Golden Ticket attack is a powerful method that threat actors can use to gain almost unlimited access within an Active Directory domain.

Windows Crisis After Crowstrike Update: A Comprehensive Guide on Root Cause and Mitigation

process analysis helps in establishing a baseline of the normal processes that should be running. It makes it easier to identify threat actors or malicious activity. check out this article. <link>https://lnkd.in/eJ_NDsJB</link>

Ewon Cosy+ Command Injection: The Ewon Cosy+ is a VPN gateway used for remote access and maintenance in industrial environments. Due to improper neutralization of parameters read from a user-controlled configuration file, an authenticated attacker is able to inject and execute OS commands on the device.