CVE-2019-7711

An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the user controlled shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addresses...

CVE-2019-7715

CVE-2019-7715 affects Green Hills INTEGRITY RTOS 5.0.4 via the Interpeak IPCOMShell TELNET server. The main shell handler uses the environment variable ipcom.shell.greeting as the first argument to printf(), making it possible for an attacker to supply a user-controlled format string during login...

CVE-2019-7715

An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf. Setting this variable using the sysvar command results in a...

CVE-2019-7712

The CVE-2019-7712 issue affects Green Hills INTEGRITY RTOS 5.0.4, specifically the Interpeak IPCOMShell TELNET server. When a user runs pwd, the current working directory path is passed as the first argument to printf() without proper validation, enabling an attacker to craft a path with format s...

CVE-2019-7711

An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the user controlled shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addresses...

CVE-2019-7711

CVE-2019-7711 affects the Interpeak IPCOMShell TELNET server in Green Hills INTEGRITY RTOS 5.0.4. The vulnerability arises from an undocumented shell command, "prompt", which sets the shell’s prompt value and is used as a format string input to printf, enabling an information leak of memory addre...

PT-2019-18716 · Green Hills +1 · Integrity Rtos +1

Name of the Vulnerable Software and Affected Versions: Green Hills INTEGRITY RTOS version 5.0.4 Description: An issue in the Interpeak IPCOMShell TELNET server allows an attacker to forge a path containing format string modifiers when using the pwd command. This results in an information leak of...

Warning: ASUS Software Update Server Hacked to Distribute Malware

Remember the CCleaner hack? CCleaner hack was one of the largest supply chain attacks that infected more than 2.3 million users with a backdoored version of the software in September 2017. Security researchers today revealed another massive supply chain attack that compromised over 1 million...

Operation ShadowHammer

Earlier today, Motherboard published a story by Kim Zetter on Operation ShadowHammer, a newly discovered supply chain attack that leveraged ASUS Live Update software. While the investigation is still in progress and full results and technical paper will be published during SAS 2019 conference in...

OPENSUSE-SU-2019:0197-1 Security update for avahi

This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses DOS bsc1120281 This update was imported from the SUSE:SLE-15:Update update project...

PT-2019-4685 · Redis +9 · Redis +11

Name of the Vulnerable Software and Affected Versions: Python versions 2.x through 2.7.16 Python versions 3.x through 3.7.3 Description: An issue in the urllib2 and urllib modules allows for CRLF injection if an attacker controls a url parameter. This can be demonstrated by the first argument to...

Mozilla Firefox Incorrect Source Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 66, which stems from a privilege notification that fails to properly display the originating domain when requesting WebRTC...

CVE-2018-15532

SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses...

CVE-2018-15532

SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses...

activejob: Information Exposure through deserialization using GlobalId

A deserialization flaw, leading to an information exposure flaw, was found in the activejob component used by Red Hat CloudForms and Red Hat Satellite. An attacker can use this flaw to leak memory addresses belonging to the aforementioned applications...

CVE-2018-15532

SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses...

CVE-2018-15532

The CVE-2018-15532 entry concerns the Synaptics TouchPad driver (SynTP.sys). It states that before 2018-06-06, local users could obtain sensitive information about freed kernel addresses, enabling information disclosure. Connected documents from HP and Lenovo corroborate that the vulnerability in...

Threat Roundup for March 8 to March 15

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 08 and March 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

An Email Marketing Company Left 809 Million Records Exposed Online

A exposed database belonging to Verifications.io contained both personal and business information, including 763 million unique email addresses...

CVE-2019-0540

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'...