Skip to content

Penetration Testing

CVE-2025-53770 (Microsoft SharePoint)

Description: Deserialization vulnerability enabling unauthenticated RCE via the /_layouts/15/ToolPane.aspx endpoint. Technical Details: CVSS Score: 9.8 (Critical) Exploit: Attackers craft malicious ASPX payloads (spinstall0.aspx) to exploit unsafe deserialization, extracting ValidationKey and DecryptionKey from __VIEWSTATE. Spoofed Referer headers (/layouts/SignOut.aspx) bypass authentication. The exploit chains with CVE-2025-49704 (spoofing, CVSS 8.8) and CVE-2025-49706 (RCE bypass), deploying .dll payloads (SHA256:… Read More »CVE-2025-53770 (Microsoft SharePoint)

Dior Data Breach

Overview French luxury brand Dior suffered a data breach exposing customer and employee data, attributed to Chinese state-sponsored actors, likely DCHSpy, linked to the ShinyHunters group via a third-party vendor breach (LVMH). Technical Details: Attack Vector: Exploited a misconfigured AWS S3 bucket with public read permissions (“Effect”: “Allow”, “Principal”: “*”) and no IAM role-based controls,… Read More »Dior Data Breach

Weekly Report: New Hacking Techniques and Critical CVEs July 21-27, 2025

This week’s critical cybersecurity developments (July 21–27, 2025) encompass actively exploited zero-days, industrial control system vulnerabilities, and sophisticated ransomware and APT activity surfacing on underground forums. Microsoft SharePoint servers continue under siege via the “ToolShell” exploit chain (CVE-2025-49706, CVE-2025-49704), while Google Chrome’s V8 engine suffered an in-the-wild type-confusion zero-day (CVE-2025-6554). Multiple high-severity flaws in Honeywell’s… Read More »Weekly Report: New Hacking Techniques and Critical CVEs July 21-27, 2025

Weekly Report: New Hacking Techniques and Critical CVEs July 14-21, 2025

The week of July 14-21, 2025, witnessed an unprecedented escalation in cybersecurity threats with multiple critical zero-day vulnerabilities under active exploitation, sophisticated state-sponsored attacks, and a major international law enforcement operation against Russian cybercriminals. The period was characterized by maximum-severity vulnerabilities achieving immediate weaponization, advanced persistent threat campaigns deploying next-generation malware, and coordinated international cybercrime… Read More »Weekly Report: New Hacking Techniques and Critical CVEs July 14-21, 2025

HPE Networking Instant On Access Points Vulnerabilities (CVE-2025-37103, CVE-2025-37102): Hardening Network Infrastructure

Overview On July 18, 2025, HPE disclosed two vulnerabilities in its Networking Instant On Access APs: CVE-2025-37103 (CVSS 9.8, hard-coded credentials) and CVE-2025-37102 (CVSS 7.2, authenticated command injection). These flaws allow attackers to bypass authentication and execute arbitrary commands with elevated privileges. Explanation CVE-2025-37103 involves hard-coded credentials in HPE Instant On Access Points, enabling attackers… Read More »HPE Networking Instant On Access Points Vulnerabilities (CVE-2025-37103, CVE-2025-37102): Hardening Network Infrastructure

Use Cases
Technology
About
Partner
Resources

FireCompass – An EC Council Ecosystem Company.
©2025 . All Rights Reserved.