CVE-2020-13497

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in String Type Index. This vulnerability could be used to bypass mitigations and aid further exploitatio...

CVE-2020-28922

CVE-2020-28922 affects Devid Espenschied PC Analyser up to version 4.10, where the PCADRVX64.SYS kernel driver exposes IOCTLs that allow a low-privilege user to read and write arbitrary physical memory. This leads to potential arbitrary Ring-0 code execution and privilege escalation. The connecte...

Improper neutralization of null byte leads to read overrun

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior...

Pixar OpenUSD binary file format offset seek information leak vulnerability

Summary An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. A specially crafted malformed file can trigger an arbitrary out-of-bounds memory access that could lead to the disclosure of sensitive information. This vulnerability could be used...

CVE-2019-9813

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...

Patriot Viper RGB Local Elevation of Privilege Vulnerability

The Patriot Viper RGB is a memory module device from Patriot Corporation of Taiwan, China. A local elevation of privilege vulnerability exists in the MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB versions prior to 1.1, which can be exploited by a local attacker to read or write to memory...

CVE-2019-16098

The driver in Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These...

Safari Webkit Proxy Object Type Confusion Exploit

This Metasploit module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the...

Chrome 72.0.3626.119 FileReader Use-After-Free

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86', 'Description' = %q This exploit takes advantage of a use after free vulnerability...

Mozilla: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...

Mozilla Firefox ESR < 60.6.1

The version of Firefox ESR installed on the remote Windows host is prior to 60.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-10 advisory. - Incorrect handling of \proto\ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for...

Security vulnerabilities fixed in Firefox 66.0.1 — Mozilla

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write...

Mozilla Firefox < 66.0.1

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 66.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-09 advisory. - Incorrect handling of \proto\ mutations may lead to type confusion in IonMonkey JIT code and can be leverag...

CVE-2018-19321

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate...

PT-2018-3846

Name of the Vulnerable Software and Affected Versions GIGABYTE APP Center versions 1.05.21 and earlier AORUS GRAPHICS ENGINE versions prior to 1.57 XTREME GAMING ENGINE versions prior to 1.26 OC GURU II version 2.08 and earlier Description The issue is related to the GPCIDrv and GDrv low-level...

CVE-2018-19321

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate...

CVE-2018-10710

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate...

EUVD-2017-9469

The timercreate syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent-sigevnotify field, which leads to out-of-bounds access in the showtimer function called when /proc/$PID/timers is read. This allows userspace applications ...

Speculative Store Bypass

ISSUE DESCRIPTION Contemporary high performance processors may use a technique commonly known as Memory Disambiguation, whereby speculative execution may proceed past unresolved stores. This opens a speculative sidechannel in which loads from an address which have had a recent store can observe a...

Razer Synapse rzpnk.sys Local Elevation of Privilege Vulnerability

Razer Synapse is a Razer device configuration software from Razer USA. A security vulnerability exists in the rzpnk.sys file in Razer Synapse version 2.20.15.1104. A local attacker can exploit the vulnerability to read or write to an arbitrary memory location to gain privileges...