CVE-2019-13085

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa...

CVE-2019-13085

CVE-2019-13085 affects XnView Classic 2.48. The publicly disclosed detail is a User Mode Write access violation starting at xnview+0x000000000030ecfa, indicating a write fault in user mode. The CVE entries consistently reference XnView Classic 2.48 and describe a write-AV condition; CVSS metrics ...

CVE-2019-13084

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739...

CVE-2019-13084

CVE-2019-13084 affects XnView Classic 2.48. Affected component is the XnView executable where a User Mode Write AV starts at xnview+0x000000000026b739, implying memory corruption leading to an access violation. Public documentation in connected sources confirms the vendor/CM details (e.g., Red Ha...

CVE-2019-13083

Affected software: XnView Classic 2.48. The CVE-2019-13083 entry describes a User Mode Write AV starting at xnview+0x0000000000384e2a. CVSS metrics in the NVD indicate a HIGH impact (CVSS3.0: base score 7.8, LOCAL, privileges NONE, user interaction REQUIRED; confidentiality/ integrity/ availabili...

CVE-2019-13083

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a...

Node.js: loader.js is not secure

Summary: Node.js loader.js can be exploited by an attacker The vulnerability https://github.com/nodejs/node/blob/a33c3c6d33fa81fa59a5aa95246d7f599e6abdd3/lib/internal/modules/cjs/loader.jsL892 js Module.initPaths = function var homeDir; var nodePath; if isWindows homeDir = process.env.USERPROFILE...

CVE-2019-12893

Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868...

CVE-2019-12898

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at image00400000+0x000000000017a45e...

CVE-2019-12899

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at ntdll!RtlQueueWorkItem+0x00000000000005e3...

Code injection

Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868...

Code injection

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at ntdll!RtlQueueWorkItem+0x00000000000005e3...

Code injection

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at image00400000+0x000000000017a45e...

CVE-2019-12898

CVE-2019-12898 affects Delta Electronics DeviceNet Builder 2.04. The vulnerability is a User Mode Write AV originating at image00400000+0x000000000017a45e, indicating an access violation. Documents do not specify exploitation status, specific vectors, or remediation steps. NVD metrics indicate a ...

CVE-2019-12898

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at image00400000+0x000000000017a45e...

CVE-2019-12893

CVE-2019-12893 affects Alternate Pic View 2.600 and describes a vulnerability where a User Mode Write AV occurs starting at PicViewer!PerfgrapFinalize+0x00000000000a8868. Public sources (NVD, Red Hat) reiterate this description. CVSS3 base metrics indicate a high impact on availability (AV:H) wit...

Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel

As a penetration tester at Coalfire Labs, I frequently use exploitation frameworks such as Metasploit or PowerShell Empire to perform post-exploitation actions on compromised endpoints. While anti-virus AV bypass and detection avoidance is often trivial in all but the most mature environments,...

Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP and AV bypass, AMSI patched

Salsa Tools is a collection of three different tools that combined, allows you to get a reverse shell on steroids in any Windows environment without even needing PowerShell for it's execution. In order to avoid the latest detection techniques AMSI, most of the components were initially written on...

Three Common Questions (and Answers) About Next-Gen AV

Most organizations with traditional, or legacy, antivirus AV solutions are well aware that they are no longer protected from the more advanced tactics and threats of attackers today. Signatures just can’t keep up with emerging threats. But that doesn’t mean that everyone is ready to dive head fir...

Arbitrary file deletion

Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could allow an attacker to delete files on the resident system without elevated privileges...