CVE-2019-11842

Affected products: Matrix Sydent < 1.0.3 and Matrix Synapse

Rockwell Automation/Allen-Bradley MicroLogix Controllers <= 16.00 Predictable Value Range

Binary data 720125.prm...

CVE-2019-11808: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

Churning Out Machine Learning Models: Handling Changes in Model Predictions

Introduction Machine learning ML is playing an increasingly important role in cyber security. Here at FireEye, we employ ML for a variety of tasks such as: antivirus, malicious PowerShell detection, and correlating threat actor behavior. While many people think that a data scientist’s job is...

CVE-2019-0729

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'...

The vulnerabilities of Intel, ARM, and AMD processors stem from the unique workings of the branch prediction module, which allows attackers to exploit the protected information.

The vulnerabilities of Intel, ARM, and AMD processors are related to the characteristics of the branch prediction module’s operation. Exploiting these vulnerabilities allows attackers to disclose confidential information by creating conditions for incorrect branch predictions...

FAAD2 Invalid Memory Address Dereference Vulnerability (CNVD-2019-07895)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. An invalid memory address dereference vulnerability in the ltprediction function of libfaad/ltpredict.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8 can be exploited by an...

ALPINE-CVE-2018-20358

An invalid memory address dereference was discovered in the ltprediction function of libfaad/ltpredict.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service...

DEBIAN-CVE-2018-20358

An invalid memory address dereference was discovered in the ltprediction function of libfaad/ltpredict.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service...

UBUNTU-CVE-2018-20358

An invalid memory address dereference was discovered in the ltprediction function of libfaad/ltpredict.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service...

Microsoft AI competition explores the next evolution of predictive technologies in security

Predictive technologies are already effective at detecting and blocking malware at first sight. A new malware prediction competition on Kaggle will challenge the data science community to push these technologies even furtherto stop malware before it is even seen. The Microsoft-sponsored competiti...

Tools for capturing and analyzing keyboard input paired with microphone capture

The main goal is to exploit the sound produced by pressing keyboard keys as a side channel in order to guess the content of the text being typed. To achieve this, the algorithm takes as input a training set, consisting of an audio recording, together with the corresponding keys being typed during...

PT-2018-3073

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 FAAD2 version 2.8.8 Description The issue is related to an invalid memory address dereference in the lt prediction function, which can cause a segmentation fault and application crash, leading to denial of...

Libav Buffer Out-of-Bounds Read Vulnerability

Libav is a cross-platform solution for recording and converting audio and video, which includes a libavcodec encoder. In Libav version 12.3, a heap buffer out-of-bounds read vulnerability exists in the 'ffvc1preddc' function of the vc1block.c file, which can be exploited to cause a denial of...

F5 Networks BIG-IP : Side-channel processor vulnerabilities (K91229003)

The following three side-channel attacks were publicly disclosed on January 3, 2018 : CVE-2017-5715 Spectre-BTB previously known as Spectre Variant 2 Branch target injection Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosu...

Shopify: H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Description: The /:id/sandbox/googlemaps and /:id/sandbox/googleautocomplete routes on checkout.shopify.com are used to render the Google Map on the "Order Status" page as well as the address prediction on checkout pages. The page performs origin validation on incoming postMessages making sure th...

EulerOS Virtualization 2.5.0 : kvm (EulerOS-SA-2018-1233)

According to the version of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of...

CVE-2018-16239: Use of Insufficiently Random Values

An issue was discovered in damiCMS V6.0.1. It relies on the PHP time function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses...

openSUSE Security Update : kernel-firmware (openSUSE-2018-825) (Spectre)

This update for kernel-firmware to version 20180525 fixes the following issues : This security issue was fixed : - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735 This...

Explained: What is big data?

If the pile of manure is big enough, you will find a gold coin in it eventually. This saying is used often to explain why anyone would use big data. Needless to say, in this day and age, the piles of data are so big, you might end up finding a pirate’s treasure. How big is the pile? But when is t...