ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 5/30: Santesoft Vulnerability, Urgent iOS Update, NHS Cyberattacks, Asus Router Compromise, Google Chrome Patch, Podcast Highlights

Cyber Daily 5/30: Santesoft Vulnerability, Urgent iOS Update, NHS Cyberattacks, Asus Router Compromise, Google Chrome Patch, Podcast Highlights

Welcome to your ONSEC Cyber Daily for May 30th. Today, we're diving into a whirlwind of vulnerabilities, patches, and cyberattacks that are shaking the tech world. First up, we have a critical vulnerability in Santesoft's Sante DICOM Viewer Pro that could allow attackers to disclose information

Cyber Daily 5/29: Toll Fee Scams Alert, XenServer VM Flaw, WooCommerce Plugin Vulnerability, Ivanti NHS Data Risk, Pakistan's Massive Data Breach, Google Chrome & ASUS Updates

Cyber Daily 5/29: Toll Fee Scams Alert, XenServer VM Flaw, WooCommerce Plugin Vulnerability, Ivanti NHS Data Risk, Pakistan's Massive Data Breach, Google Chrome & ASUS Updates

Cyber Daily 5/28: DragonForce Ransomware Exploits SimpleHelp, Pakistan's 180M User Data Breach, Microsoft's Critical Security Flaws, Adobe's Remote Code Execution Vulnerability

Cyber Daily 5/28: DragonForce Ransomware Exploits SimpleHelp, Pakistan's 180M User Data Breach, Microsoft's Critical Security Flaws, Adobe's Remote Code Execution Vulnerability

Cyber Daily 5/27: Chinese Hackers Target US via Cityworks Exploit, vBulletin Forum Vulnerability Exposed, India's Microsoft Security Alert, Oracle TNS Flaw, Patch Updates for Ivanti, Fortinet, Linux Kernel

Cyber Daily 5/27: Chinese Hackers Target US via Cityworks Exploit, vBulletin Forum Vulnerability Exposed, India's Microsoft Security Alert, Oracle TNS Flaw, Patch Updates for Ivanti, Fortinet, Linux Kernel

Cyber Daily 5/22: Apple's AirBorne Flaw Threatens iPhones, Attaxion Teams Up with ENISA, SideWinder Exploits Legacy Office Vulnerabilities, Cybersecurity Podcasts Gain Traction

Cyber Daily 5/22: Apple's AirBorne Flaw Threatens iPhones, Attaxion Teams Up with ENISA, SideWinder Exploits Legacy Office Vulnerabilities, Cybersecurity Podcasts Gain Traction

Cyber Daily 5/19: Ankit Tiwari Cyber Attack, High-Severity Alert for Chrome Users, AI Widening Cybersecurity Gaps in Morocco, Microsoft Patches Exploited Vulnerabilities

Cyber Daily 5/19: Ankit Tiwari Cyber Attack, High-Severity Alert for Chrome Users, AI Widening Cybersecurity Gaps in Morocco, Microsoft Patches Exploited Vulnerabilities

Cyber Daily 5/23: Firefox, Chrome Vulnerabilities Alert by NCERT, German Cyber Agency Warns of Grid Threats, WhatsApp Security Flaws, Chinese Hackers Exploit Cityworks Bug, Multiple CVEs Patched

Cyber Daily 5/23: Firefox, Chrome Vulnerabilities Alert by NCERT, German Cyber Agency Warns of Grid Threats, WhatsApp Security Flaws, Chinese Hackers Exploit Cityworks Bug, Multiple CVEs Patched

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'