CVE-2022-3094

Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions ACLs and is...

UBUNTU-CVE-2022-3094

Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions ACLs and is...

Vim Code Execution

The vulnerability in the src/normal.c component of the Vim text editor is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

SMB2 Server Message Block Security Bypass

The vulnerability of the Server Message Block Version 2 SMB2 implementation in the Snort intrusion detection system of the Cisco Firepower Threat Defense FTD microprogramming network interface devices, the Cisco Meraki MX network devices, the Cisco Cyber Vision industrial network security control...

Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2023-025-01)

The version of bind installed on the remote host is prior to 9.16.37 / 9.18.11. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-025-01 advisory. - BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client- timeout is...

Python Exec, Command Shell, Bind TCP (via python)

Execute a Python payload from a command. Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+. Module Options msf use payload/cmd/windows/python/shellbindtcp msf payloadshellbindtcp show actions ...actions... msf payloadshellbindtcp set...

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The legitimate command-and-control C2 framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week. Sliver...

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The legitimate command-and-control C2 framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week. Sliver...

The getMaxTreeBrackets function does not handle the case when the suffixes array cannot be created due to memory constraints.

Lines of code Vulnerability details Impact if MaxTreeHeight is set to a very large value, such as 10^9, and twoSubstringLength is also set to a large value, such as 100, then the suffixes array would require 10^9 100 bytes of memory to be created. If the contract does not have that much memory...

PDF viewing buffer overflow

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud are related to buffer overflows in dynamic memory. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

Adobe InDesign Buffer Overflow

The vulnerability of Adobe InDesign’s computer layout automation tool is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country. "The Gamaredon group's network infrastructure...

WordPress Contact Form 7 Dynamic Text Extension Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Dynamic Text Extension Type Plugin Vulnerable versions = 2.0.3 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 64fbad36bbc4 Credits Unknow...

GSD-2023-1000296 tracing: Free buffers when a used dynamic event is removed

tracing: Free buffers when a used dynamic event is removed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.226 by commit...

GSD-2023-1000241 tracing: Free buffers when a used dynamic event is removed

tracing: Free buffers when a used dynamic event is removed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.158 by commit...

GSD-2023-1000168 tracing: Free buffers when a used dynamic event is removed

tracing: Free buffers when a used dynamic event is removed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.82 by commit...

GSD-2023-1000074 tracing: Free buffers when a used dynamic event is removed

tracing: Free buffers when a used dynamic event is removed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by commit...

PT-2023-33245 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 2.6.33 through 5.15.81 Description: The issue concerns the removal of used dynamic events, which may lead to the freeing of buffers. This problem was introduced in version v2.6.33 and is fixed in version v5.15.82...

PT-2023-33373 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.226 Description: The issue concerns the removal of used dynamic events, which may lead to security implications. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

PT-2023-33318 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.158 Description: The issue concerns the removal of used dynamic events, which may lead to the freeing of buffers. This could potentially have security implications, although the actual impact and attack...