Mozilla Firefox 访问控制错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that plain text validation messages may be overwritten on another source through the use of the reportValidi...

New Android Malware Steals Financial Data from 378 Banking and Wallet Apps

The operators behind the BlackRock mobile malware have surfaced back with a new Android banking trojan called ERMAC that targets Poland and has its roots in the infamous Cerberus malware, according to the latest research. "The new trojan already has active distribution campaigns and is targeting...

edge.js 跨站脚本漏洞

edge.js is the Node.js template engine. edges.js versions prior to 5.3.2 have a cross-site scripting vulnerability that stems from a type obfuscation vulnerability that can be exploited to bypass input cleanup when the input to be rendered is an array, even if is used, and can be used by attacker...

Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

In this blog entry we look into a fileless campaign that used a new HCrypt variant to distribute numerous remote access trojans RATs in victim systems. This new variant also uses an updated obfuscation mechanism which we detail...

Wasmtime 代码问题漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A code issue vulnerability exists in Wasmtime that stems from Wasmtime prior to version 0.30.0 being affected by a type obfuscation vulnerability...

BoobSnail - Allows Generating Excel 4.0 XLM Macro

BoobSnail allows generating XLM Excel 4.0 macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation. Features: various infection techniques; various obfuscation techniques; translation of formulas into languages other than English; can be used as a library - you can easily...

Google Chrome Type Obfuscation Vulnerability (CNVD-2021-92834)

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in the Blink layout in versions prior to Google Chrome 93.0.4577.82. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Adobe Acrobat和Adobe Reader 代码问题漏洞

Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat is a PDF editing software developed by Adobe. Adobe Acrobat/Reader suffers from a type obfuscation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Google chrome 安全漏洞

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in the Blink layout in versions prior to Google Chrome 93.0.4577.82. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Ragnar Locker Gang Warns Victims Not to Call the FBI

All that the FBI/ransomware negotiators/investigators do is muck things up, so we’re going to publish your stuff if you call for help, the Ragnar Locker ransomware gang announced on its darknet data-leak site. In an announcement posted this week and seen by Bleeping Computer, the ransomware...

Too Log; Didn't Read — Unknown Actor Using CLFS Log Files for Stealth

The Mandiant Advanced Practices team recently discovered a new malware family we have named PRIVATELOG and its installer, STASHLOG. In this post, we will share a novel and especially interesting technique the samples use to hide data, along with detailed analysis of both files that was performed...

Exploit for CVE-2021-1675

CVE-2021-1675RDLLPE A CS reflection loading plugin for the...

Laurent Rineau CGAL Code Execution Vulnerability

Laurent Rineau CGAL is an open source application from Laurent Rineau. Providing access to geometric algorithms in the form of a C library, Laurent Rineau CGAL suffers from a security vulnerability that could be exploited by an attacker to cause out-of-range reads and type obfuscation through the...

Laurent Rineau CGAL Code Execution Vulnerability (CNVD-2022-32788)

Laurent Rineau CGAL is an open source application from Laurent Rineau. It provides access to geometric algorithms in the form of C libraries. Laurent Rineau CGAL suffers from a security vulnerability that can be exploited by an attacker to cause out-of-range reads and type obfuscation via a...

Laurent Rineau CGAL Code Execution Vulnerability (CNVD-2022-32787)

Laurent Rineau CGAL is an open source application from Laurent Rineau. It provides access to geometric algorithms in the form of C libraries. Laurent Rineau CGAL suffers from a security vulnerability that can be exploited by an attacker to cause out-of-range reads and type obfuscation via a...

CGAL 输入验证错误漏洞

Laurent Rineau CGAL is an open source application from Laurent Rineau. It provides access to geometric algorithms in the form of C libraries. Laurent Rineau CGAL suffers from a security vulnerability that can be exploited by an attacker to cause out-of-range reads and type obfuscation via a...

object-path 安全漏洞

object-path is a personal developer's Npm library for accessing variables in data structures via paths. object-path versions prior to 0.11.6 have a security vulnerability that results from a type obfuscation vulnerability when the path component used in the path parameter is an array. No details ...

New variant of Konni malware used in campaign targetting Russia

This blog post was authored by Hossein Jazi In late July 2021, we identified an ongoing spear phishing campaign pushing Konni Rat to target Russia. Konni was first observed in the wild in 2014 and has been potentially linked to the North Korean APT group named APT37. We discovered two documents...

Google Chrome Type Obfuscation Vulnerability (CNVD-2021-68456)

Chrome, a web browsing tool developed by Google, is vulnerable to a type obfuscation vulnerability in V8 in versions prior to Google Chrome 92.0.4515.159. An attacker could exploit this vulnerability to execute arbitrary code inside a sandbox via a crafted HTML page...

CVE-2021-0639

In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...