CVE-2019-0010 Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of Service

An SRX Series Service Gateway configured for Unified Threat Management UTM may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packet inspected by UTM consumes mbufs which...

Microsoft Windows - Windows Error Reporting Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits Microsoft Windows - Windows Error Reporting Local Privilege Escalation Exploit Make sure to copy the file report.wer found in the folder PoC-Files in the same folder as the executable before running it... I guess I could have included it as ...

Microsoft Windows - Windows Error Reporting Local Privilege Escalation

Microsoft Windows - Windows Error Reporting Local Privilege Escalation Make sure to copy the file report.wer found in the folder PoC-Files in the same folder as the executable before running it... I guess I could have included it as a resource in the exe.. but whatever. Example:...

Microsoft Windows - Windows Error Reporting Local Privilege Escalation

Make sure to copy the file report.wer found in the folder PoC-Files in the same folder as the executable before running it... I guess I could have included it as a resource in the exe.. but whatever. Example: "angrypolarbearbug.exe c:\windows\system32\drivers\pci.sys" This will overwrite pci.sys...

CB Customer Spotlight: Q&A with Kaas Tailored’s Joe Mrazik

For the past eight years, Joe Mrazik has taken on the role of Network Administrator for Kaas Tailored, protecting the company’s endpoints with CB Defense. Kaas Tailored is an aerospace and furniture manufacturing company that supplies parts to aerospace companies like Boeing. Read on to learn how...

PT-2022-11257 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: Gpac versions through 1.0.1 Description: A null pointer dereference vulnerability exists via the gf avc parse nalu function in av parsers.c when using mp4box, which causes a denial of service. This issue leads to a segmentation fault...

Sql injection

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12238

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

Sql injection

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12239

CVE-2018-12239 affects Norton 22.15 and certain Symantec Endpoint Protection (SEP) lines prior to 12.1.7454.7000 and 14.2, SEP SBE prior to NIS-22.15.1.8/SEP-12.1.7454.7000, and SEP Cloud prior to 22.15.1. The issue is an AV bypass vulnerability where one antivirus engine relies on a signature da...

CVE-2018-12238

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12238

CVE-2018-12238 is an AV bypass affecting Norton/Symantec endpoint products. Affected include Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 and 14.2; SEP SBE prior to NIS-22.15.1.8 and SEP-12.1.7454.7000; and SEP Cloud prior to 22.15.1. The issue enables evading...

CVE-2018-12239

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

SEP Multiple Issues

SUMMARY Symantec has released updates to address issues that were discovered in the Norton, Symantec Endpoint Protection SEP, Symantec Endpoint Protection Small Business Edition SEP SBE and Symantec Endpoint Protection Cloud SEP Cloud products. AFFECTED PRODUCTS Norton --- CVE | Affected Versions...

Why Malwarebytes decided to participate in AV testing

Starting this month, Malwarebytes began participating in the antivirus software for Windows comparison test performed by AV-test.org. This is uncharted territory for us, as we have refrained from participating in these types of tests since our inception. Although recent testing results show...

Emotet Campaign Ramps Up with Mass Email Harvesting Module

A large-scale spam campaign has launched, spreading the Emotet banking trojan. Worryingly, the offensive has launched about a week after a fresh module for mass email-harvesting was detected for the malware. Emotet is technically a banking trojan, but it’s most often used as a dropper for a varie...

Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

Consider this scenario: Two never-before-seen, heavily obfuscated scripts manage to slip past file-based detection and dynamically load an info-stealing payload into memory. The scripts are part of a social engineering campaign that tricks potential victims into running the scripts, which use the...

Adwind RAT Scurries By AV Software With New DDE Variant

A newly-discovered spam campaign is spreading the Adwind 3.0 remote-access tool RAT – and using a fresh take on the Dynamic Data Exchange DDE code-injection technique for anti-virus evasion. The spam campaign features two types of droppers that leverage a new variant to the already-known DDE...

Adwind Dodges AV via DDE

This blog post is authored by Paul Rascagneres, Vitor Ventura and with the contribution of Tomislav Pericin and Robert Perica from ReversingLabs. Introduction Cisco Talos, along with fellow cybersecurity firm ReversingLabs, recently discovered a new spam campaign that is spreading the Adwind 3.0...

Microsoft Windows Defender AV: Threat alert levels at which default action should not be taken (Medium)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavthreatseveritydefaultaction2.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify threat alert levels at which default action should not be taken when detected Medium Authors: Emanuel Moss Copyright: Copyright...