The vulnerability of the mechanism for checking SCTP fragments in WebRTC browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SCTP fragment checking mechanism in WebRTC browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability can allow an attacker to gain access to confidentia...

Cisco AnyConnect Secure Mobility Client for Windows Profile Modification (cisco-sa-anyconnect-profile-7u3PERKF)

According to its self-reported version, Cisco AnyConnect Secure Mobility Client is affected by a vulnerability in the interprocess communication IPC channel due to insufficient validation of user-supplied input. An authenticated, local attacker can exploit this, by sending a crafted IPC message t...

MMS Exploit Part 5: Defeating Android ASLR, Getting RCE

Posted by Mateusz Jurczyk, Project Zero This post is the fifth and final of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. Previous posts are...

CVE-2020-7029

A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...

CVE-2020-7029

A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...

CVE-2020-7029

The CVE-2020-7029 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. Affected products/versions are Communication Manager 7.0.x, 7.1.x before 7.1.3.5, and 8.0.x; Messaging ...

CVE-2020-7029 Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...

Yokogawa CENTUM (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Yokogawa Equipment: CENTUM Vulnerabilities: Improper Authentication, Path Traversal 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-224-01...

chromium-browser: Inappropriate implementation in WebRTC

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream...

Cisco AnyConnect Secure Mobility Client for Windows DoS

According to its self-reported version, Cisco AnyConnect Secure Mobility Client is affected a vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service DoS condition ...

Denial Of Service (DoS)

busybox is vulnerable to denial of service. The recvandprocessclientpkt function in networking/ntpd.c allows remote attackers to cause a excessive CPU and bandwidth consumption via a malicious NTP packet, which triggers a communication loop...

Black Hat 2020: Satellite Comms Globally Open to $300 Eavesdropping Hack

Satellite internet communications are susceptible to eavesdropping and signal interception by far-flung attackers located in a different continent or country from their victims. And all they need is $300 worth of off-the-shelf equipment to pull it off. That’s the word from James Pavur, an academi...

chromium-browser: Inappropriate implementation in WebRTC

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream...

The vulnerability of the WebRTC technology implemented in Google Chrome browsers allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WebRTC technology implemented in Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failures through a specially...

Cisco AnyConnect Secure Mobility Client Configuration File Modification Vulnerability

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. A configuration file modification vulnerability exists in the Inter-Process Communication IPC channel in Cisco AnyConnect Secure Mobility Client...

Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. A denial of service vulnerability exists in the interprocess communication IPC channel in Cisco AnyConnect Secure Mobility Client for Windows 4.9.000...

Afternoon Cyber Tea: Revisiting social engineering: The human threat to cybersecurity

Most of us know ‘Improv’ through film, theatre, music or even live comedy. It may surprise you to learn that the skills required for improvisational performance art, can also make you a good hacker? In cybersecurity, while quite a bit of focus is on the technology that our adversaries use, we mus...

Black Hat Presentation - Web Cache Entanglement

Overview Akamai is aware of the 'Web Cache Entanglement: Novel Pathways to Poisoning' presentation at BlackHat on August 5, 2020. Two security vulnerabilities related to our content delivery networks' caching functionality were presented as part of this research. Akamai would like to thank James...

Cisco AnyConnect Secure Mobility Client for Windows Profile Modification Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on th...