Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

Consider this scenario: Two never-before-seen, heavily obfuscated scripts manage to slip past file-based detection and dynamically load an info-stealing payload into memory. The scripts are part of a social engineering campaign that tricks potential victims into running the scripts, which use the...

IBM Rational Requirements Composer and Rational DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability in IBM Rational...

CVE-2018-1610

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2018-1610

IBM Rational DOORS Next Generation (RDNG) versions affected: 5.0–5.0.2 and 6.0–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause details...

PT-2018-13411

Name of the Vulnerable Software and Affected Versions IBM Rational DOORS Next Generation versions 5.0 through 5.0.2 IBM Rational DOORS Next Generation versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionalit...

CVE-2018-1610: Improper Neutralization of Input During Web Page Generation

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

Prezi Next Access Bypass Vulnerability

Prezi Next is a presentation editing tool. An access bypass vulnerability exists in Prezi Next version 1.3.101, which can be exploited by attackers to bypass access restrictions...

Design/Logic Flaw

Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...

CVE-2018-17137

Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...

CVE-2018-17137

Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...

CVE-2018-17137

Prezi Next 1.3.101.11 is affected by an access bypass vulnerability described across multiple sources (e.g., CNVD-2018-19438, NVD CVE-2018-17137). The issue arises from SE_DEBUG_PRIVILEGE on Windows, which could allow attackers to bypass intended access restrictions in the context of HTML5 presen...

CVE-2018-17137

Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...

CVE-2018-17137: Undefined Security Weakness

Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...

PT-2018-13917

Name of the Vulnerable Software and Affected Versions Prezi Next version 1.3.101.11 Description The issue concerns a potential bypass of intended access restrictions. Prezi Next is designed to create HTML5 presentations, but it has SE DEBUG PRIVILEGE on Windows, which could be exploited by...

CVE-2018-16743: Out-of-bounds Write

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

Contiki-NG Buffer Over-Read Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer over-read vulnerability exists in lookup in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial of service...

PT-2018-13750

Name of the Vulnerable Software and Affected Versions libbson version 1.12.0 Description The issue is related to a heap-based buffer over-read in the bson iter next internal function in bson-iter.c via a crafted bson buffer. Recommendations For libbson version 1.12.0, at the moment, there is no...

Contiki-NG buffer overflow vulnerability (CNVD-2019-09779)

Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer overflow vulnerability exists in lvmshiftforoperator in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial...

CVE-2018-16665

An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvmshiftforoperator in os/storage/antelope/lvm.c...

CVE-2018-16663

An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parserelations in os/storage/antelope/aql-parser.c while parsing AQL storage of relations...