CVE-2020-24349

CVE-2020-24349 affects njs up to version 0.4.3 used in NGINX, enabling a control-flow hijack in njs_value_property within njs_value.c. Public sources confirm the issue, with Red Hat and PT-Security entries citing vulnerable versions prior to 0.4.4 and recommending upgrading to 0.4.4+ to resolve. ...

CVE-2020-24349

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

Design/Logic Flaw

Insufficient control flow management for some IntelR Wireless BluetoothR products may allow an unprivileged user to potentially enable denial of service via adjacent access...

CVE-2019-14620

CVE-2019-14620 involves insufficient control flow management in Intel Wireless Bluetooth products, potentially allowing an unprivileged actor to cause a denial of service via adjacent access. The connected Intel advisory (INTEL-SA-00337) confirms the flaw, lists affected Intel Wireless Bluetooth ...

CVE-2019-14620

Insufficient control flow management for some IntelR Wireless BluetoothR products may allow an unprivileged user to potentially enable denial of service via adjacent access...

PT-2020-15700 · Nginx · Njs

Name of the Vulnerable Software and Affected Versions: njs versions prior to 0.4.4 Description: The issue allows for control-flow hijack in the njs value property function within njs value.c. It is noted that the vendor considers this issue to be of minimal concern in the NGINX use case due to th...

PT-2020-9581

Name of the Vulnerable Software and Affected Versions: IntelR Wireless BluetoothR products affected versions not specified Description: The issue is related to insufficient control flow management, which may allow an unprivileged user to potentially enable denial of service via adjacent access...

CVE-2020-24349: Use After Free

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

GReAT thoughts: Awesome IDA Pro plugins

The Global Research & Analysis Team here at Kaspersky has a tradition of meeting up once a month and sharing cutting-edge research, interesting techniques and useful tools. We recently took the unprecedented decision to make our internal meetings public for a few months and present them as a seri...

Exploit for Out-of-bounds Write in F5 Nginx

CVE-2013-2028 Exploit Vulnerability details Vulnerable so...

This Week in Security News: Intel Says ‘Tiger Lake’ Will Drown Control-Flow Malware and New Phishing Campaign Targeting Office 365 Exploits Brand Names

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how the next generation of Intel mobile processors will include malware protection built into the chip. Also, read about a new...

Intel Adds Anti-Malware Protection in Tiger Lake CPUs

Intel’s upcoming class of mobile CPUs, code named “Tiger Lake,” will feature a long anticipated security layer, called Control-flow Enforcement Technology CET, which aims to protect against common malware attacks. CET protects against attacks on processors’ control flow, which refers to the order...

CVE-2020-8675

Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-8675

The CVE-2020-8675 issue affects the Intel® Innovation Engine Build and Signing Tool prior to version 1.0.859. The root cause is insufficient control flow management in the firmware build and signing tool, which could let an unauthenticated user escalate privileges via physical access. Impact is e...

CVE-2020-8675

Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

Stable Channel Update for Desktop

The stable channel has been updated to 81.0.4044.129 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH)

Exploit Title: Rubo DICOM Viewer 2.0 - Buffer Overflow SEH Exploit Author: bzyo Date: 2020-04-17 Vulnerable Software: Rubo Medical Imaging - DICOM Viewer 2.0 Vendor Homepage: http://www.rubomedical.com/ Version: 2.0 Software Link : http://www.rubomedical.com/download/index.php Tested Windows 7 SP...