Can you review my new security testing tool [https://github.com/MohamedKarrab/odoomap](https://github.com/MohamedKarrab/odoomap)
Features:
• Detect Odoo version & exposed metadata
• Enumerate databases and accessible models
• Authenticate & verify CRUD permissions per model
• Extract data from chosen models (e.g.res.users, res.partner)
• Brute-force login credentials (default, custom user/pass, wordlists)
• Brute-force internal model names when listing fails
Lets imagine a scenario where you're coerced whether through threats, torture, or even legal pressure to reveal the password to your secure vault.
In countries like the US, UK, and Australia, refusing to provide passwords to law enforcement can result months in prison in certain cases.
I invented a solution called [Veilith](https://www.veilith.com/) ( [veilith.com](http://veilith.com/) ) addresses this critical vulnerability with perfect deniable encryption. It supports multiple passwords, each unlocking distinct blocks of encrypted data that are indistinguishable from random noise even to experts. And have a lot of different features to protect your intellectual properties.
In high-stakes situations, simply provide a decoy password and plausibly deny the existence of anything more.
Dive deeper by reading the whitepaper, exploring the open-source code, or asking me any questions you may have.
In the past few years, I’ve worked closely with enterprise security teams to improve their open source governance processes. One recurring theme I keep seeing is this: most organizations *know* they have issues with OSS component vulnerabilities—but they’re stuck when it comes to actually governing them.
To better understand this, we analyzed the top 20 most vulnerable open source components commonly found in enterprise Java stacks (e.g., `jackson-databind`, `shiro`, `mysql-connector-java`) and realized something important:
Vulnerabilities aren’t just about CVE counts—they’re indicators of systemic governance blind spots.
Here’s the full article with breakdowns:
[**From the Top 20 Open Source Component Vulnerabilities: Rethinking the Challenges of Open Source Security Governance**](#)
Over 200 Malicious Open Source Packages Traced to Lazarus Campaign
Source: https://www.infosecurity-magazine.com/news/200-malicious-open-source-lazarus/
ShinyHunters behind Salesforce data theft attacks at Qantas, Allianz Life, and LVMH
Source: https://www.bleepingcomputer.com/news/security/shinyhunters-behind-salesforce-data-theft-attacks-at-qantas-allianz-life-and-lvmh/
SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
Source: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-critical-rce-flaw-in-sma-100-VPN-appliances/
Mateusz Lewczak explains how the AFD.sys driver works under the hood on Windows 11. In Part 1 [1], he demonstrates how to use WinDbg and the NtCreateFile call to manually craft a raw TCP socket, bypassing the Winsock layer entirely.
Part 2 of the series [2] dives into the bind and connect operations implemented via AFD.sys IOCTLs. Mateusz shows how to intercept and analyze IRP packets, then reconstruct the buffer needed to perform the three‑way TCP handshake by hand in kernel mode.
[1] https://leftarcode.com/posts/afd-reverse-engineering-part1/
[2] https://leftarcode.com/posts/afd-reverse-engineering-part2/
Lumma infostealer malware returns after law enforcement disruption
Source: https://www.bleepingcomputer.com/news/security/lumma-infostealer-malware-returns-after-law-enforcement-disruption/
New Fortinet FortiWeb hacks likely linked to public RCE exploits
Source: https://www.bleepingcomputer.com/news/security/new-fortinet-fortiweb-hacks-likely-linked-to-public-rce-exploits/
For unknown, and regrettable, reasons, these 2 awesome utilities now embeds adwares !
It is recent:
- For CrystalDiskMark, this starts from version 9.0.0.
- For CrystalDiskInfo, this starts from version 9.7.0
You can see the "*ads.exe" files:
- hxxps://sourceforge.net/projects/crystaldiskmark/files/9.0.1/
- hxxps://sourceforge.net/projects/crystaldiskmark/files/9.0.0/
- hxxps://sourceforge.net/projects/crystaldiskinfo/files/9.7.0/
More explanations here: hxxps://forums.tomshardware.com/threads/is-crystaldiskinfo-still-safe.3882065/
RCE in the Most Popular Survey Software You’ve Never Heard Of
Source: https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
