cKure Red

🟥 Zero-Day: “CVE-2024-21388” - Microsoft Edge’s Marketing API Exploited for Covert Extension Installation.

https://labs.guard.io/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca

⚠️ Zero-Day: WiFi Flaw Leaves All Devices Vulnerable to ‘SSID Confusion’ Attacks.

https://www.top10vpn.com/assets/2024/05/Top10VPN-x-Vanhoef-SSID-Confusion.pdf

The Zero-Day Market | Beginners

📺https://youtu.be/TLPHmHPaCiQ

💎 IconJector: Unorthodox and stealthy way to inject a DLL into the explorer using icons.

https://github.com/0xda568/IconJector

⚙️ A simple web-based tool that lists all Content Security Policy issues on your target to help you figure out which missing directives or policies can help you bypass CSP!

https://csp-evaluator.withgoogle.com/

cKure Red pinned «🔚 Zero-Day: Option 121 (DHCP) allows bypasses nearly all VPNs TunnelVision vulnerability has existed since 2002 and may already be known to attackers. https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire…»

🔚 Zero-Day: Option 121 (DHCP) allows bypasses nearly all VPNs

TunnelVision vulnerability has existed since 2002 and may already be known to attackers.

https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/

➡️ CVE-2024-2887: A Pwn2own Winning Bug In Google Chrome.

https://www.zerodayinitiative.com/blog/2024/5/2/cve-2024-2887-a-pwn2own-winning-bug-in-google-chrome

🔴🌚 QCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames, among other things.

😴https://github.com/P1sec/QCSuper

🖥 How an 18-year-old discovered a VirtualBox VM escape vulnerability (a sandbox escape).

https://j0nathanj.github.io/Dusting-off-the-VM-Escape

🆕 XSS Bypass Cloudflare WAF 🧱

%3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E

➡️ Unclassified: Killing humans based on their social media posts.

The AI-Assisted genocide (as documents of the first-time use of AI to kill humans emerge from active duty personnel in the Israeli army and their media outlets).

The documentary by Al-Jazeera news network was supported by content and news provided by two Israeli news networks, '+972 Magazine' and 'Local Call'. These agencies received information from active Israeli personnel (working IDF members) in the field that have access to the platform and its working. The whistle-blowers cited their conscience to report the unprecedented crime by IDF against the native muslim population of Palestine 🇵🇸 in Gaza and in Jenin, West Bank.

The AI system takes primarily 6 inputs from the Israeli military. In addition, it also uses Google Maps and other sophisticated software made by Google specifically for the support of Palestinian extermination (to which the engineers at google have protested publicly and were fired as a consequence). The recent modified 'Lavender AI' is called 'Gospel' and takes input from social media accounts of Palestinians. Any activity by a Palestinian in the past or present that is against the establishment of the Israeli regime is considered a worthy kill by the AI. The 'Gospel AI' does increase the kill chances of a person if he switched his SIM cards often. This information is provided by government and private companies and entities in Israel using their spyware and telecom hacking and spying software. The AI does take the amount of collateral damage into account while deciding the kill. The amount refers to no. of people (innocents) that will die in order to kill a legitimate target (eg. A person who switched SIM cards often).

The attack by Zionist Jews ✡️ using this AI has a way to feed the collateral damage. Those parameters have been set by the top echelon of the Zionist state. The results of over 50K killed Palestinians (non-alive people directly killed by Israel and non listed humans as in foetuses).

https://www.972mag.com/lavender-ai-israeli-army-gaza/

https://www.theguardian.com/world/2024/apr/03/israel-gaza-ai-database-hamas-airstrikes

https://www.aljazeera.com/news/2024/4/4/ai-assisted-genocide-israel-reportedly-used-database-for-gaza-kill-lists

https://youtu.be/cYQcT2Lv-y4

https://www.instagram.com/reel/C3GId3qtUlp/

https://youtu.be/GFD_Cgr2zho

cKure Red pinned «⚠️ Zero-Day in SSH client 'PuTTY' assigned CVE-2024-31497 (account takeover via key guessing). Widely-Used PuTTY SSH Client Found Vulnerable to Key Recovery Attack The maintainers of the PuTTY Secure Shell (SSH) and Telnet client are alerting users of a…»

➡️PoC Exploit Released for zero-day Windows Kernel of Privilege Vulnerability (CVE-2024-21338).

https://github.com/hakaioffsec/CVE-2024-21338

https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/

🔚 Telegram fixes Windows app zero-day used to launch Python scripts. Filing link from XSS.is forum.

http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/

PoC video: https://player.vimeo.com/video/932147196

https://www.bleepingcomputer.com/news/security/telegram-fixes-windows-app-zero-day-used-to-launch-python-scripts/

⭐🔠🔠🔠🔠🔠turned 6️⃣ last month.

🎮 Bypassing anti-reversing defences in iOS applications.

https://twelvesec.com/2023/10/10/bypassing-anti-reversing-defences-in-ios-applications/

😃 A new class of vulnerability (on a lighter note). An interesting thread on watching police body cam footages.

https://twitter.com/vxunderground/status/1777121604574560462

Iran 🇮🇷 Israel 🇮🇱 Cyber-War: Israel has jammed GPS at the highest levels on its territory for fear of Iranian missile strikes, though Iran is familiar with the use of Russian GLONASS.

The attack anticipation is based on the intel by the United States's 🇺🇸 CIA about an imminent attack on Israel in the upcoming 48 hours. It has been a day since. So, the attack anticipation is today.

https://t.me/cKure/13785