Microsoft announces new Project OneFuzz framework, an open source developer tool to find and fix bugs at scale

Microsoft is dedicated to working with the community and our customers to continuously improve and tune our platform and products to help defend against the dynamic and sophisticated threat landscape. Earlier this year, we announced that we would replace the existing software testing experience...

End of Life Announcement for the Citrix Receiver for Universal Windows Platform (UWP)

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Systems, Inc. announces the End of Life of the Citrix Receiver for Universal Windows Platform...

CVE-2020-1550

An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

Delta Electronics TPEditor Buffer Overflow Vulnerability (CNVD-2020-46850)

Delta Electronics TPEditor is a Windows-based Delta text panel programming software from Delta Electronics, Taiwan, China. A buffer overflow vulnerability exists in Delta Electronics TPEditor version 1.97 and earlier. The vulnerability can be exploited by an attacker with a specially crafted...

NetApp Active IQ Unified Manager Denial of Service Vulnerability

NetApp Active IQ Unified Manager is an ONTAP storage product monitoring and management solution from US-based NetApp. The product supports features such as performance monitoring and secret key management. A security vulnerability exists in NetApp Active IQ Unified Manager VMware vSphere and...

RSA MFA Agent Cross-Site Scripting Vulnerability

RSA MFA Agent is a suite of authentication agent software. A cross-site scripting vulnerability exists in version 2.0 of the RSA MFA Agent for Windows-based platforms, which stems from a lack of proper authentication of client data by a WEB application. A local attacker can exploit this...

CVE-2020-5384

Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability by using an alternate path to bypass authentication in order to gain full access to the system...

CA Unified Infrastructure Management Nimsoft 7.80 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow', 'Description' = %q This module exploits a buffer overflow within the...

Mozilla Firefox Code Problem Vulnerability (CNVD-2020-46337)

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software separate from the Mozilla Application...

Tobesoft MiPlatform Operating System Command Injection Vulnerability

Tobesoft MiPlatform is a user graphical interface development tool from the Korean company Tobesoft. An operating system command injection vulnerability exists in the ExtCommandApi.dll file in versions of Tobesoft MiPlatform prior to 2019.05.16 for Windows-based platforms, which can be exploited ...

Foxit Studio Photo Buffer Overflow Vulnerability (CNVD-2020-65179)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A buffer overflow vulnerability exists in the processing of PNG files in Foxit Studio Photo 3.6.6.924 and earlier versions for Windows platforms, which stems from the program not properly validating...

AZL-79080 CVE-2020-14039 affecting package golang 1.25.7-1

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements if VerifyOptions.Roots equals nil and the installation is on Windows. Thus, X.509 certificate verification is incomplete...

Adobe Download Manager Injection Vulnerability

Adobe Download Manager is an application for managing and downloading Adobe products from Adobe USA. An injection vulnerability exists in version 2.0.0.518 of Adobe Download Manager for Windows-based platforms. An attacker can exploit this vulnerability to execute arbitrary code...

Mozilla Firefox Code Problem Vulnerability (CNVD-2020-46339)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 78 for Windows-based platforms. The vulnerability can be exploited by an attacker to execute arbitrary code via a malicious DLL...

Unspecified Vulnerability in IBM DB2

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2. An attacker can exploit the vulnerability to cause a denia...

The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems arises from insufficient validation of input data. This allows a malicious actor to trigger a service failure.

The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Unspecified Vulnerability in NVIDIA Windows GPU Display Driver (CNVD-2021-27725)

NVIDIA Windows GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA dedicated to the Windows platform. A security vulnerability in the Inter Process Communication APIs in the NVIDIA Windows GPU Display Driver all versions can be exploited by a local attacker to execute...

Cisco Webex Network Recording Player and Cisco Webex Player Input Validation Error Vulnerability (CNVD-2020-31990)

Cisco Webex Network Recording Player is a player for playing video conference recordings from Cisco USA. An input validation error vulnerability exists in Cisco Webex Network Recording Player and Cisco Webex Player Release prior to 3.0 MR3 Security Patch 2 and prior to 4.0 MR3 for Windows-based...

Cisco Webex Network Recording Player and Cisco Webex Player Input Validation Error Vulnerability (CNVD-2020-31968)

Cisco Webex Network Recording Player is a player for playing video conference recordings from Cisco USA. An input validation error vulnerability exists in Cisco Webex Network Recording Player and Cisco Webex Player for Windows-based platforms. An attacker can send a malicious ARF or WRF file via ...

Mozilla Firefox and Firefox ESR Input Validation Error Vulnerability (CNVD-2020-34653)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox ESR versions prior to 68.8 an...