PT-2021-15534 · X-Assign · X-Assign

Name of the Vulnerable Software and Affected Versions: x-assign versions all Description: The issue affects the global proto object, which can be polluted using the proto object. This allows for potential manipulation of the object's properties. Recommendations: For all versions, consider...

Microsoft Warns of Iran-Linked Hackers Targeting US and Israeli Defense Firms

An emerging threat actor likely supporting Iranian national interests has been behind a password spraying campaign targeting U.S., E.U., and Israeli defense technology companies, with additional activity observed against regional ports of entry in the Persian Gulf as well as maritime and cargo...

How nation-state attackers like NOBELIUM are changing cybersecurity

This is the first post in a four-part series on the NOBELIUM nation-state cyberattack. Microsoft started telling the industry about this extremely advanced cyberattack in December 2020. The NOBELIUM blog series—which mirrors Microsoft’s four-part video series “Decoding NOBELIUM”—will pull the...

wolfmqtt: Heap-buffer-overflow in MqttDecode_Num

Detailed Report: https://oss-fuzz.com/testcase?key=5146254703722496 Project: wolfmqtt Fuzzing Engine: afl Fuzz Target: wolfmqtt-fuzzer Job Type: aflasanwolfmqtt Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x621000008f07 Crash State: MqttDecodeNum MqttDecodeString...

caseylooproperty.com Cross Site Scripting vulnerability OBB-2144819

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

wolfmqtt:wolfmqtt-fuzzer: Crash in MqttDecode_Props

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=5112634807025664 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzermsanwolfmqtt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x720000011008...

Europol Busts Major Crime Ring, Arrests Over 100 Online Fraudsters

Law enforcement agencies in Italy and Spain have dismantled an organized crime group linked to the Italian Mafia that was involved in online fraud, money laundering, drug trafficking, and property crime, netting the gang about €10 million $11.7 million in illegal proceeds in just a year. "The...

PT-2021-24398

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows a target object to access and modify certain properties of a source object when copying properties from the source to the target. This can lead to unauthorized...

PT-2021-27794

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ crash occurred, involving the functions cdf read property info, cdf unpack summary info, and cdf check summary info...

Denial of Service Vulnerability in Gbase 8a

GBase 8s is a secure database management system with full intellectual property rights. A denial-of-service vulnerability exists in Gbase 8a, which can be exploited by an attacker to cause the program to crash...

Linux Implementation of Cobalt Strike Beacon Targeting Organizations Worldwide

Researchers on Monday took the wraps off a newly discovered Linux and Windows re-implementation of Cobalt Strike Beacon that's actively set its sights on government, telecommunications, information technology, and financial institutions in the wild. The as-yet undetected version of the penetratio...

PT-2021-27769

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several function calls, including cdf read property info, cdf unpack summary...

Improper Handling of Missing Values in kaml

Impact Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with t...

CVE-2021-39194

kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in...

Prototype Pollution

objection is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the set and zipObject function...

Design/Logic Flaw

In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of...

CVE-2021-40523

In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of...

Prototype Pollution in Proto

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

Immer 代码问题漏洞

Immer is a Javascript-based state management library from the Immer community. A code issue vulnerability exists in Immer that stems from the product's susceptibility to improper control of object prototype properties. The vulnerability can be exploited by an attacker to cause information...

Prototype Pollution in open-graph

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload...