8978 matches found
D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
D-Link won’t patch a critical unauthenticated command-injection vulnerability in its routers that could allow an attacker to remotely take over the devices and execute code. The vulnerability CVE-2019-16920 exists in the latest firmware for the DIR-655, DIR-866L, DIR-652 and DHP-1565 products,...
CVE-2019-16263
The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such as a lack of hostname verification. NOTE: this is an...
Code injection
The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such as a lack of hostname verification. NOTE: this is an...
B2R2 - Collection Of Useful Algorithms, Functions, And Tools For Binary Analysis
B2R2 is a collection of useful algorithms, functions, and tools for binary analysis , written purely in F in .NET lingo, it is purely managed code. B2R2 has been named after R2-D2, a famous fictional robot appeared in the Star Wars. In fact, B2R2's original name was B2-R2 , but we decided to use...
AG Barr, Officials to Facebook: Don't Encrypt Messaging
U.S. Attorney General William Barr is among government officials asking Facebook CEO Mark Zuckerberg to halt or at least delay a plan to add end-to-end encryption to its messaging services in an effort to bolster consumer privacy. The move, unveiled Thursday, once again sparked the privacy debate...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
ALPINE-CVE-2019-15161
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data at the end of a request...
DEBIAN-CVE-2019-15161
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data at the end of a request...
October 3, 2019—KB4524149 (OS Build 17134.1040)
None None...
October 3, 2019—KB4524151 (OS Build 15063.2079)
None None...
October 3, 2019—KB4524150 (OS Build 16299.1421)
None None...
October 3, 2019—KB4524152 (OS Build 14393.3243)
None None...
HTTP/2: 0-length headers lead to denial of service
A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...
September 24, 2019—KB4516061 (OS Build 14393.3242)
None None...
September 24, 2019—KB4516045 (OS Build 17134.1039)
None None...
September 24, 2019—KB4516059 (OS Build 15063.2078)
None None...
VMSA-2019-0014 : Use-after-free vulnerability
ESXi use-after-free vulnerability - CVE-2019-5527 ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. A local attacker with non-administrative access on the guest machine may exploit this issue to execute code on the host. This...
September 23, 2019—KB4522011 (OS Build 15063.2046)
None None...
