Kudou Music Box PC client software suffers from a dll file loading vulnerability

Kudou Music Box is a music resource aggregator and player that combines the functions of song and MV search, download, online playback, lyrics synchronization display and so on. A dll file loading vulnerability exists in the Kudou Music Box PC client software, which can be exploited by attackers ...

DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-07939)

DiliCMS is a content management system CMS based on Codelgniter. A cross-site scripting vulnerability exists in the site URL text box in DiliCMS version 2.4.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2018-17420

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

PT-2019-5750 · Poppler +4 · Poppler +4

Name of the Vulnerable Software and Affected Versions: Poppler version 0.74.0 Description: The issue is related to a heap-based buffer over-read in the downsample row box filter function located in CairoRescaleBox.cc. This can potentially allow a remote attacker to access confidential data,...

Workspace: Personal Cloud Connectors

This article provides the steps necessary to utilize connectors for Box, Dropbox, and other third-party storage apps in Citrix Workspace...

CVE-2019-8911

An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...

CVE-2019-5596

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to ga...

WECON V-Box Detection (Windows SMB Login)

Detects the installed version of WECON V-Box for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2018-20751

An issue was discovered in croppage in PoDoFo 0.9.6. For a crafted PDF document, pPage-GetObject-GetDictionary.AddKeyPdfName"MediaBox",var can be problematic due to the function GetObject being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL...

UBUNTU-CVE-2018-20751

An issue was discovered in croppage in PoDoFo 0.9.6. For a crafted PDF document, pPage-GetObject-GetDictionary.AddKeyPdfName"MediaBox",var can be problematic due to the function GetObject being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL...

Meta Box < 4.16.3 - Unauthorised File Deletion

The Meta Box – WordPress Custom Fields Framework WordPress plugin was affected by an Unauthorised File Deletion security vulnerability...

Meta Box < 4.16.2 - Mishandled Uploaded Files

The Meta Box – WordPress Custom Fields Framework WordPress plugin was affected by a Mishandled Uploaded Files security vulnerability...

CVE-2018-17703

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17688

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Bitdefender BOX 2 bootstrap download_image command injection vulnerability

Summary An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands...

Bitdefender BOX 2 bootstrap update_setup command execution vulnerability

Summary An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution o...

TAU Threat Intelligence Notification – WindTail (OSX)

Summary Dark Matter researcher Taha Karim recently presented his research on the APT group WindShift at Hack in the Box Singapore. This group primarily focuses on highly targeted campaigns directed toward Middle Eastern government and commercial entities. One of the custom macOS backdoors employe...

Oracle VM VirtualBox Access Control Error Vulnerability (CNVD-2019-27291)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The solution is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Malboxes - Builds Malware Analysis Windows VMs So That You Don'T Have To

Builds malware analysis Windows virtual machines so that you don’t have to. Requirements Python 3.3+ packer: https://www.packer.io/docs/install/index.html vagrant: https://www.vagrantup.com/downloads.html VirtualBox or an vSphere / ESXi server Minimum specs for the build machine At least 5 GB of...

KLA11405 Multiple vulnerabilities in Oracle Virtual Box

Multiple vulnerabilities were found in Oracle Virtual Box. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions and cause denial of service. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities in Core component of...