(0Day) Ashlar-Vellum Cobalt IGS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

PYSEC-2024-235

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2024-23496

A heap-based buffer overflow vulnerability exists in the GGUF library gguffreadstr functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-0243 Server-side Request Forgery In Recursive URL Loader

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2024-27283

A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed...

CVE-2024-0446

A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in t...

Veritas eDiscovery Platform Security Breach

Veritas eDiscovery Platform is a powerful engine from Veritas, Inc. for performing large-scale, dataset-driven searches to help organizations quickly identify critical parsed documents. A security vulnerability exists in Veritas eDiscovery Platform versions prior to 10.2.5, which stems from an...

CVE-2024-27283

A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed...

CVE-2024-27283

The CVE-2024-27283 issue affects Veritas eDiscovery Platform prior to 10.2.5, where an application administrator can upload potentially malicious files to arbitrary server locations. CVSS 3.1 base metrics indicate high impact (C/H, I/H, A/H) with network attack vector, low complexity, and high pr...

Autodesk AutoCAD Buffer Error Vulnerability

Autodesk AutoCAD is a suite of professional 3D drawing software from Autodesk, Inc. Autodesk AutoCAD suffers from a buffer error vulnerability that originates from an out-of-bounds write vulnerability when parsing a maliciously compiled STP, CATPART or MODEL file in ASMKERN228A.dll. An attacker...

The vulnerability of the microprogrammed control units Saho ADM100 and ADM-100FP lies in the possibility of unlimited loading of dangerous files, allowing a intruder to execute arbitrary commands.

The vulnerability of the microprogrammed control units Saho ADM100 and ADM-100FP lies in the ability to download files of a malicious nature without limitation. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely by introducing specially crafted files...

Malwarebytes crushes malware all the time

About a month ago, The PC Security Channel TPSC ran a test to check out the detection capabilities of Malwarebytes. They tested Malwarebytes by executing a repository of 2015 “malicious” files to see how many Malwarebytes would detect. This YouTube video shows how a script executes the files and...

Why Are Compromised Identities the Nightmare to IR Speed and Efficiency?

Incident response IR is a race against time. You engage your internal or external team because there's enough evidence that something bad is happening, but you're still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability ...

PT-2024-19680 · Autodesk · Autodesk Autocad

Name of the Vulnerable Software and Affected Versions: Autodesk AutoCAD affected versions not specified Description: A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW DLL.dll through Autodesk applications, can lead to a memory corruption issue by write access violation. This issue...

PT-2024-8048 · Autodesk · Autodesk Autocad

Name of the Vulnerable Software and Affected Versions: Autodesk AutoCAD affected versions not specified Description: A maliciously crafted 3DM and MODEL file, when parsed in opennurbs.dll and atf api.dll through Autodesk applications, can force an Out-of-Bound Read. This can allow a malicious act...

New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs

Since November 2023, Microsoft has observed a distinct subset of Mint Sandstorm PHOSPHORUS targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States. In this campaign,...

CVE-2024-20272

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a...

CVE-2023-39413

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns th...

CVE-2023-38650

Multiple integer overflow vulnerabilities exist in the VZT vztrdblockvchdecode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the...

CVE-2023-37574

Multiple use-after-free vulnerabilities exist in the VCD getvartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the...