CVE-2024-10573

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is...

CVE-2024-10573

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is...

CVE-2024-10573 Mpg123: buffer overflow when writing decoded pcm samples

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is...

CVE-2024-10573 Mpg123: buffer overflow when writing decoded pcm samples

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is...

Fake funeral “live stream” scams target grieving users on Facebook

Some scammers have the morals of an alley cat. But some sink even lower. Over the last few months, Malwarebytes Labs has discovered scammers active on Facebook that prey on bereaved people by using stolen images and phony funeral live stream links to steal money and/or credit card details. These...

Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure

Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure Vendor: The Akuvox Company Product web page: https://www.akuvox.com Affected version: Doorphone: S539 S532 X916 X915 X912 R29 Intercom: R20K-2 R20A-2 C313W-2 NS-2 NC-2 NX-2 Firmware: 912.30.1.137 Summary: Vandal-resistant Door Phon...

Malicious code in watch-ireland-vs-france-live-stream-online-soccer (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3879 Malicious code in watch-ireland-vs-france-live-stream-online-soccer (npm)

--- -= Per source details. Do not edit below this line.=-...

QSC23 – Qualys Announces a Directional Shift to Measure, Communicate, and Eliminate Cyber Risk with New Platform and Solutions

The 2023 Qualys Security Conference QSC started wrapping up on Thursday, November 9th, with two days of new technology announcements, impactful customer use cases, and thought-provoking talks from a host of engaging speakers, including Rachel Wilson, Managing Director at Morgan Stanley and Frank...

SUSE CVE-2018-12391

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. Note: this issu...

K12201527: Overview of F5 security notifications

Security Advisory Description F5 is making two changes to our approach going forward: hardened releases are moving to a six-week cadence, and we are pausing regular security notifications. For more information, please see this blog: Our first hardened release cycle: What we learned and how we’re...

MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability

MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability Vendor: MiniDVBLinux Product web page: https://www.minidvblinux.de Affected version: /dev/null -------------------------------------------------------------------- Tested on: MiniDVBLinux 5.4 BusyBox v1.25.1 Architecture: armhf,...

Threat Source newsletter (Oct. 21, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. We're writing this on Wednesday for PTO reasons, so apologies if we miss any major news that happens after Wednesday afternoon. Above, you can watch our awesome live stream from Monday with Brad Garnett from... This is only the...

Selea Targa IP OCR-ANPR Camera Stream Disclosure

Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure Vendor: Selea s.r.l. Product web page: https://www.selea.com Affected version: Model: iZero Targa 512 Targa 504 Targa Semplice Targa 704 TKM Targa 805 Targa 710 INOX Targa 750 Targa 704 ILB Firmware: BLD201113005214...

Selea Targa 512 IP OCR-ANPR Camera - Stream Disclosure (Unauthenticated)

Exploit Title: Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure Unauthenticated Date: 07.11.2020 Exploit Author: LiquidWorm Vendor Homepage: https://www.selea.com Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure Vendor: Selea s.r.l. Product web...

Arteco Web Client DVR/NVR - 'SessionId' Brute Force

Exploit Title: Arteco Web Client DVR/NVR - 'SessionId' Brute Force Date: 16.11.2020 Exploit Author: LiquidWorm Vendor Homepage: https://www.arteco-global.com !/usr/bin/env python3 Arteco Web Client DVR/NVR 'SessionId' Cookie Brute Force Session Hijacking Exploit Vendor: Arteco S.U.R.L. Product we...

SUSE-SU-2020:1211-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed: - Update to version 2.28.2 bsc1170643: + Fix excessive CPU usage due to GdkFrameClock...

Fedora 31 : webkit2gtk3 (2020-7f34d2cfd8)

Update to 2.28.2 : - Fix excessive CPU usage due to GdkFrameClock not being stopped. - Fix UI process crash when EGLWLbindwaylanddisplay extension is not available. - Fix position of select popup menus in X11. - Fix playing of Youtube live stream/H264 URLs. - Fix several crashes and rendering...

YouPHPTube LiveChat Plugin SQL Injection Vulnerability

YouPHPTube is an open source YouTube clone script. A SQL injection vulnerability exists in the LiveChat plugin in YouPHPTube 7.7 and earlier versions. The vulnerability stems from a failure to properly validate user input passed via the livestreamcode POST parameter to...

iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure

iSeeQ Hybrid DVR WH-H4 2.0.0.P - getjpeg Stream Disclosure Title: iSeeQ Hybrid DVR WH-H4 2.0.0.P - getjpeg Stream Disclosure Date: 2019-10-29 Author: LiquidWorm Vendor:iSeeQ Link: http://www.iseeq.co.kr CVE: N/A !/bin/bash iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P getjpeg Stream Disclosure Vendor:...