Go hack some NVIDIA shit.

RE: https://infosec.exchange/@cR0w/115231558276357271 And now we have a watchTowr write-up. :dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:

watchTowr Labs

Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

File transfer used to be simple fun - fire up your favourite FTP client, log in to a glFTPd site, and you were done. Fast forward to 2025, and the...

I also appreciate them publishing it despite the conclusion. It's insightful despite not reaching their research goal, and they don't make wild speculations like some researchers tend to. View quoted note →

npub1s6ee...n008 3 months ago

Y'all like parties where you bring your own VD, right? Here you go then.

BYOVD to the next level (part 1) — exploiting a vulnerable driver (CVE-2025-8061) - Quarkslab's blog

Bring Your Own Vulnerable Driver (BYOVD) is a well-known post-exploitation technique used by adversaries. This blog post is part of a series. We wi...

npub1s6ee...n008 3 months ago

I'm not saying this one is intentional, but it sure feels negligent at best. https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/sev:HIGH 8.2 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N > The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. > The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers. and > While OnePlus does advertise a public bug bounty program for reporting vulnerabilities, Rapid7 cannot engage with their bug bounty program due to its restrictive Non Disclosure Agreement (NDA) terms and conditions. Therefore CVE-2025-10184 is being disclosed as not fixed by the vendor at the time of disclosure. https://www.cve.org/CVERecord?id=CVE-2025-10184

npub1s6ee...n008 3 months ago

Please vote no:

Infosec Exchange

GAYINT (@gayint@infosec.exchange)

Chat, one of our puppygirls is asking for toot privileges. Should we give them to her? #GAYINT #puppygirl [ ] Arf arf arf (yes) [ ] Woof (No)

npub1s6ee...n008 3 months ago

RE: https://infosec.exchange/@cR0w/115227978540947435 Looks like the advisory from Fortra is live. It was 404 when I posted the CVE yesterday. https://www.fortra.com/security/advisories/product-security/fi-2025-012 View quoted note →

npub1s6ee...n008 3 months ago

Another perfect 10 for Fortra. 🥳 This is a command injection in GoAnywhere. Happy hacking. https://www.cve.org/CVERecord?id=CVE-2025-10035 > A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

npub1s6ee...n008 3 months ago

Microsoft published three OOB CVEs. None listed as 0days so IDK what's up. Maybe Patch Tuesday is dying? That would be... interesting.

Security Update Guide - Microsoft Security Response Center

npub1s6ee...n008 3 months ago

I didn't realize Group-IB was trying to one-up Crowdstrike with profile cards on their threat actor profiles. :-/ https://www.group-ib.com/blog/muddywater-infrastructure-malware/