The vulnerability of software for researching and detecting YARA-infected programs, related to integer overflow, allows attackers to access confidential data and cause service interruptions.

The vulnerability of software for detecting and identifying YARA-infected programs is related to integer overflow. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, as well as cause service interruptions...

The vulnerability of the syntactic analyzer in the mac80211 subsystem of the Linux operating system’s kernel allows a perpetrator to trigger a service failure due to pointer arithmetic errors.

The vulnerability of the syntactic analyzer in the mac80211 subsystem of the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability allows an attacker to cause a service failure by injecting a 802.11a frame...

The vulnerability of the highly efficient pglogical logical replication system, related to the failure to cleanse input data, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the highly efficient pglogical logical replication system is related to the failure to perform data cleansing on input data. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of the client-server WebSocket library in Node-ws software, related to uncontrolled resource consumption, allows attackers to trigger a service failure.

The vulnerability of the client-server WebSocket library in Node-ws software is related to an incorrect interpretation of the “Sec-Websocket-Protocol” header. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the general proxy server RADIUS software Radsecproxy, related to insufficient input data validation, allows a perpetrator to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the general proxy server RADIUS software Radsecproxy is related to the lack of input validation in the scripts “naptr-eduroam.sh” and “radsec-dynsrv.sh”. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cau...

Facebook down with Messenger, Instagram, WhatsApp service disruption

By Waqas Facebook down? Yes, Facebook is down along with Messenger, Instagram, WhatsApp, and Oculus VR due to DNS-related issues. You are not alone; the social media giant Facebook along with its subsidiaries including Messenger, Instagram, WhatsApp, and Oculus VR are down and suffering ongoing...

The vulnerability in the implementation of the malloc, realloc, and memalign functions of the Apache Nuttx operating system allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the malloc, realloc, and memalign functions in the Apache Nuttx operating system arises due to integer overflow. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

The vulnerability of the Indexed DB API for browser storage interfaces in Google Chrome and Microsoft Edge allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Indexed DB API for browser-based structured data storage in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code through a specially...

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge browsers allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service interruptions or execute arbitrary code through a specially created web page...

CVE-2021-37105

There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal...

A guide to combatting human-operated ransomware: Part 2

This blog is part two of a two-part series focused on how Microsoft DART helps customers with human-operated ransomware. For more guidance on human-operated ransomware and how to defend against these extortion-based attacks, refer to our human-operated ransomware docs page. In part one of this bl...

A guide to combatting human-operated ransomware: Part 2

This blog is part two of a two-part series focused on how Microsoft DART helps customers with human-operated ransomware. For more guidance on human-operated ransomware and how to defend against these extortion-based attacks, refer to our human-operated ransomware docs page. In part one of this bl...

Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description No CSRF token and GET requests allowed in Data and Metadata imports Proof of Concept 1. Login as administrator 2. Create a directory called test in /import directory and put a CSV file inside 3. On the browser with administrator cookies, visit...

CVE-2021-22949

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security CMS Research Team"...

VulnCheck KEV: CVE-2022-1388

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services...

Concrete CMS 跨站请求伪造漏洞

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. Concrete CMS suffers from a cross-site request forgery vulnerability that allows an attacker to exploit the vulnerability to copy files, which can lead to an inconvenie...

mysql: C API unspecified vulnerability (CPU Jan 2021)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

Three Surefire Ways to Boost the Digital Banking Experience

The year 2020 disrupted just about every industry, including retail banking. Locked down at home, consumers were abruptly forced to do all their banking over the internet. The sudden transition profoundly impacted banks and created unprecedented demands on online infrastructure. Some banking site...

CVE-2021-3795

A flaw was found in the semver-regex library where it could lead to consuming a big amount of resources when executing specific strings. Attackers could take advantage of this by crafting an invalid version causing a disruption or a denial of service DoS...

The vulnerability of the savevm function in the QEMU hardware emulation software involves unsafe management of privileges, allowing a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the savevm function in the QEMU hardware emulation software relates to the ability to modify data stored in savevm. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...