New DNS Vulnerability Lets Attackers Launch Large-Scale DDoS Attacks

Israeli cybersecurity researchers have disclosed details about a new flaw impacting DNS protocol that can be exploited to launch amplified, large-scale distributed denial-of-service DDoS attacks to takedown targeted websites. Called NXNSAttack, the flaw hinges on the DNS delegation mechanism to...

The vulnerability of the Istio network software lies in the insufficient processing of regular expressions for long URIs, allowing attackers to trigger service failures.

The vulnerability of the Istio network software is related to the insufficient processing of regular expressions for long URIs. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the implementations of Secure Sockets Layer and Transport Layer Security protocols in the microsoftware for Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) allows a attacker to induce a service failure.

The vulnerability of the Secure Sockets Layer and Transport Layer Security implementations in Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD software lies in an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to caus...

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box allows a hacker to trigger a maintenance failure.

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box devices is related to an operation where data escapes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failure...

The vulnerability of Cisco Firepower Threat Defense’s microprogramming software, related to uncontrolled resource consumption, allows attackers to trigger a service failure.

The vulnerability of Cisco Firepower Threat Defense’s microprogramming software is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the rpcapd/daemon.c component in the libpcap library allows a hacker to trigger a service failure.

The vulnerability of the rpcapd/daemon.c component in the libpcap library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

The vulnerability of the ReadMPCImage function in the GraphicsMagick graphics editor, related to resource management errors, allows a hacker to cause a service failure.

The vulnerability of the ReadMPCImage function in the GraphicsMagick graphics editor is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by using a specially created image file...

The vulnerability of the multimedia library libvpx, related to insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability of the multimedia library libvpx is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the GraphicsMagick graphic editor, related to reading beyond the buffer in memory, allows a hacker to cause a service failure.

The vulnerability of the GraphicsMagick graphic editor is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions using a specially created xwd file...

The vulnerability of the microDNS library in the VideoLAN VLC media player software allows a hacker to induce a service failure or execute arbitrary code.

The vulnerability of the microDNS library in the VideoLAN VLC media player lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code through a specially crafted request...

The vulnerability of the UnicodeString::doAppend function in the International Components for Unicode library, related to integer overflow in the data structure, allows an attacker to gain unauthorized access to confidential data, trigger a service failure, or compromise the integrity of the data.

The vulnerability of the UnicodeString::doAppend function in the International Components for Unicode library is related to integer overflow in the data structure. Exploitation of this vulnerability could allow an attacker to gain unauthorized access to confidential data, cause service failures, ...

The vulnerability of the microDNS library in the VideoLAN VLC media player software allows a hacker to induce a service failure or execute arbitrary code.

The vulnerability of the microDNS library in the VideoLAN VLC media player lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code through a specially crafted request...

CVE-2020-6247

CVE-2020-6247 affects SAP Business Objects BI Platform, version 4.2. An unauthenticated attacker can send specially crafted requests to crash or flood the Central Management Server, impacting system availability. The available connected documents corroborate the impact (availability disruption) a...

The vulnerability of the Astra Linux Directory service’s EPPT management system, related to improper authorization, allows a perpetrator to access confidential data and also trigger a service failure.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an authentication error for local users. Exploiting this vulnerability can allow attackers to access confidential data and also cause service failures...

The vulnerability of the input tool provided by Astra Linux SE/CE in the MS Windows AD domain “astra-winbind” allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the Astra Linux SE/CE input device in MS Windows AD domain, known as astra-winbind, is related to a user login error. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

Zoom Beefs Up End-to-End Encryption to Thwart 'Zoombombers'

Video calling platform Zoom is boosting its security profile via the acquisition of a small startup called Keybase. The 25-person, New York-based company will provide more robust encryption for Zoom calls on paid subscriptions by implementing an end-to-end architecture. “Logged-in users will...

The vulnerability of the V8 component in Google Chrome browsers allows a hacker to gain unauthorized access to confidential data, cause service failures, or compromise data integrity.

The vulnerability of Google Chrome’s V8 component relates to access to data without type control. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to confidential data, cause service failures, or compromise data integrity through a specially created HTML page...

The vulnerability of many elements of the DAViCal calendar exchange server, related to deficiencies in mechanisms for combating cross-site fraud, allows attackers to gain unauthorized access to confidential data, cause service failures, and compromise data integrity.

The vulnerability of many components of the DAViCal calendar exchange server is related to deficiencies in mechanisms for combating cross-site fraud. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to confidential data, cause service failures, and compromise...

The vulnerability of the Google Chrome audio browser component, related to the use of memory after it is freed, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the Google Chrome audio browser component is related to a memory management issue after deallocation. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...