VNG Security Response Center

We are the VNG Security Response Center. To report security vulnerabilities or abuse in VNG products, visit

[VNG Security Response Center @vngsecresponse]

We've successfully developed a new PoC exploit for CVE-2024-3400 PAN-OS Command Injection without the Telemetry enablement requirement. Please patch it ASAP 🌐
#CVE-2024-3400

[VNG Security Response Center @vngsecresponse]

Oops! V.A.R check: Bug collision! Hopefully we'll have better luck next year. Kudos to our guys @ducnt_ @tuo4n8 @xchym @n3mohb also thanks to ZDI with awesome event.

[TrendAI Zero Day Initiative @thezdi]

Collision – The VNG Security Response Center was able to execute a 2-bug chain against the QNAP TS-464. However, the exploit they used was previously known. They still earn $5,000 and 1 Master of Pwn point. #Pwn2Own

[VNG Security Response Center @vngsecresponse]

Our team has successfully reproduced PoC for CVE-2023-2825 GitLab Arbitrary file read via uploads path traversal. Only effect to GitLab 16.0.0 version. Patch it ASAP 😁😉.

[VNG Security Response Center @vngsecresponse]

We're really happy to share our improvements and some experiments for the CookieMonster tool.

Weaponizing Monster for Cookies Attacks: https://t.co/zUlvGEHTkr

Also include burp-extender plugin for burp suite. Hope you guys enjoy it.

~Cheers,
VSRC

[VNG Security Response Center @vngsecresponse]

Ladies and Gentlemen: The new Dojo opens to welcome black belt Hackers to fight for honor!!! #VSRC

Liferay revisited: A tale of 20k$. https://t.co/Opa58lorMO
Hope you guys enjoy it and stay tuned for more technique writeups / blogs / exploits ... will come.

~Cheers,
VSRC