pocsuite

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, known as Pocsuite. It is developed by the Knownsec Security Team and comes with a powerful proof-of-concept engine, many niche features for penetration testers and security researchers. The framewo...

OSV-2020-677 Heap-buffer-overflow in load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15007 Crash type: Heap-buffer-overflow READ 4 Crash state: load rbinobjectnew rbinfilenewfrombuffer...

Raonwiz CyMiInstaller322 ActiveX Code Issue Vulnerability

Raonwiz CyMiInstaller322 ActiveX is a version control program from the Korean company Raonwiz. A security vulnerability exists in File Download in Raonwiz CyMiInstaller322 ActiveX 2016.5.26.1 and earlier versions, which stems from the program failing to adequately perform an authentication...

COVID-19 Risks of Flying

I fly a lot. Over the past five years, my average speed has been 32 miles an hour. That all changed mid-March. It's been 105 days since I've been on an airplane -- longer than any other time in my adult life -- and I have no future flights scheduled. This is all a prelude to saying that I have be...

CVE-2020-15007

A buffer overflow in the MLoadDefaults function in mmisc.c in id Tech 1 aka Doom engine allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument...

Mattermost Server Information Disclosure Vulnerability (CNVD-2020-35456)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in the initialload API in Mattermost Server versions prior to 3.2.0. An attacker can exploit this vulnerability to obtain personal information...

monero:load-from-json_fuzz_tests: Global-buffer-overflow in epee::misc_utils::parse::match_string2

Project: https://github.com/monero-project/monero.git Detailed Report: https://oss-fuzz.com/testcase?key=5096090558005248 Project: monero Fuzzing Engine: libFuzzer Fuzz Target: load-from-jsonfuzztests Job Type: libfuzzerasanmonero Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

The vulnerability of the full_load method and the FullLoader loader from the PyYAML library allows a attacker to execute arbitrary code.

The vulnerability of the fullload method and the FullLoader loader from the PyYAML library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

microcode_ctl security, bug fix and enhancement update

3:1.17-33.26.0.1 - update 06-2d-07 to 0x71a - update 06-55-04 to 0x2006906 - update 06-55-07 to 0x5002f01 - merge Oracle changes for early load via dracut - enable late load on install for UEK4 kernels marked safe except BDW-79 - set earlymicrocode='no' in virtualized guests to avoid early load...

The vulnerability of the IG_load_file function in the ImageGear image processing library allows a hacker to execute arbitrary code.

The vulnerability of the IGloadfile function in the ImageGear image processing library is related to the output of the operation outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created ICO file...

EulerOS 2.0 SP2 : nginx (EulerOS-SA-2020-1644)

According to the version of the nginx package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read...

DEBIAN-CVE-2020-14212

FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

UBUNTU-CVE-2020-14212

FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

Nokogiri: Command injection

Background Nokogiri is an HTML, XML, SAX, and Reader parser. Description A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby’s Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is being...

PT-2020-8502 · Adns +2 · Adns +2

Name of the Vulnerable Software and Affected Versions: adns versions prior to 1.5.2 Description: An issue was discovered in adns where it hangs and consumes CPU resources if a compression pointer loop is encountered. Recommendations: For versions prior to 1.5.2, update to version 1.5.2 or later t...

A Bug in Facebook Messenger for Windows Could've Helped Malware Gain Persistence

Cybersecurity researchers at Reason Labs, the threat research arm of security solutions provider Reason Labs, today disclosed details of a vulnerability they recently discovered in the Facebook Messenger application for Windows. The vulnerability, which resides in Messenger version 460.16, could...

CVE-2020-0218

In loadSoundModel and related functions of SoundTriggerHwService.cpp, there is possible out of bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0181

In exifdataloaddatathumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID...

UBUNTU-CVE-2020-0198

In exifdataloaddatacontent of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-14642894...