Scripting Engine Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard CFG to be bypassed. By itself, the CFG bypass vulnerability does not allow arbitrary code execution. However, an attacker could use the CFG bypass vulnerability in conjunction wi...

Polar fitness app exposed location data of users in military & airbases

By Waqas Polar Flow, an app developed by Polar, a Finland based sports This is a post from HackRead.com Read the original post: Polar fitness app exposed location data of users in military & airbases...

Polar Fitness App Exposes Location of ‘Spies’ and Military Personnel

Fitness device maker Polar Flow suspended an Explore tracking feature on its mobile app after researchers discovered profile and geolocation data of high-ranking military personnel and “spies” that were being exposed to the public on its network. In a report released by Dutch publication De...

Integer overflow

The mintToken function of a smart contract implementation for Flow, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13525

The mintToken function of a smart contract implementation for Flow, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13525

CVE-2018-13525 concerns a mintToken function in a Flow (Ethereum) token contract that contains an integer overflow. The overflow enables the contract owner to set the balance of an arbitrary user to any value. Documents identify the affected component as a smart contract implementation and specif...

openvswitch/flow_extract_fuzzer: Heap-buffer-overflow in parse_icmpv6

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5457710546944000 Project: openvswitch Fuzzer: libFuzzeropenvswitchflowextractfuzzer Fuzz target binary: flowextractfuzzer Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type:...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

CVE-2018-11560

The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100...

Stack overflow

The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100...

CVE-2018-11560

CVE-2018-11560 affects the Insteon HD IP Camera White 2864-222 webService binary, where a stack-based buffer overflow can cause control-flow hijacking via a crafted usr key, evidenced by a long remoteIp to CGIProxy.fcgi (port 34100). Related sources describe a related remote-code execution impact...

CVE-2018-11560

The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100...

Announcing Changes to Microsoft’s Mitigation Bypass Bounty

Today we’re announcing a change to the Mitigation Bypass Bounty that removes Control Flow Guard CFG from the set of in-scope mitigations. In this blog, we’ll provide additional background and explain why we’re making this change. Mitigation Bypass Bounty Background Mitigation Bypass Bounty...

Announcing Changes to Microsoft’s Mitigation Bypass Bounty

Today we’re announcing a change to the Mitigation Bypass Bounty that removes Control Flow Guard CFG from the set of in-scope mitigations. In this blog, we’ll provide additional background and explain why we’re making this change. Mitigation Bypass Bounty Background Microsoft started the Mitigatio...

CVE-2018-10623

Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote...

Out-of-bounds

Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote...

CVE-2018-10623

Delta Electronics DOPSoft (HMI editor) versions 4.00.04 and earlier are affected by CVE-2018-10623 due to an out-of-bounds read in memory buffers when the position is derived from values in a .dpa file. The issue in the DPA file parsing can allow remote code execution, alteration of control flow,...

CVE-2018-10623

Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote...

Security Bulletin: IBM QRadar SIEM is vulnerable to DOS attack via malicious packets. (CVE-2015-5044)

Summary QRadar Flow Collector DOS vulnerability while processing certain flows received from network Vulnerability Details CVE-ID: CVE-2015-5044 Description: IBM QRadar SIEM QFLOW component is susceptible to a DOS attack when an attacker sends certain packet types. CVSS Base Score: 4.3 CVSS...

Security Bulletin: IBM MQ Invalid channel protocol flows cause denial of service on HP-UX (CVE-2016-8915)

Summary An invalid TSH flow could result in the termination of any channels running on threads within the same responding MCA process on the HP-UX platform. Vulnerability Details CVEID: CVE-2016-8915 DESCRIPTION: For an authenticated user with access to the queue manager and queue, IBM MQ might...