The vulnerability of the execution environment for remote process calls in the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the execution environment for remote process calls in the Windows operating system exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the execution environment for remote process calls in the Windows operating system allows attackers to exploit their privileges.

The vulnerability of the execution environment for remote process calls in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

SysWhispers2 - AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference BetweenSysWhispers 1 and 2 The usage is almost identical to SysWhispers1 but...

Rock RMS File Upload / Account Takeover / Information Disclosure

Title ========================= Multiple vulnerabilities found in Rock RMS including RCE and account takeover. A total of three CVEs were issued for the vulnerabilities CVE-2019-18641, CVE-2019-18642, CVE-2019-18643 Product Description ========================= Rock RMS is an open source CRM...

Denial Of Service (DoS)

Xen is vulnerable to denial of service. A stack overflow due to recursive function calls allows an attacker to crash the application...

Zammad Access Control Error Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Denial Of Service (DoS)

gobby is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

Null pointer dereference

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 is affected by a NULL pointer dereference in the D-Bus handler for certain set_language calls. The issue, described as a denial-of-service risk (crash) on the targeted app, is noted across multiple advisories (e.g., Arch Linux ASA-202101-26) with upstream fixes referenced (upgrade to...

Microsoft Warns CrowdStrike of Hackers Targeting Azure Cloud Customers

New evidence amidst the ongoing probe into the espionage campaign targeting SolarWinds has uncovered an unsuccessful attempt to compromise cybersecurity firm Crowdstrike and access the company's email. The hacking endeavor was reported to the company by Microsoft's Threat Intelligence Center on...

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

...

The vulnerability of the Linux operating system’s kernel, related to the use of memory after it is freed, allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to disclose sensitive information by using system calls such as ioctls KDGKBSENT and KDSKBSENT...

CVE-2020-35609

A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls can cause a denial of service. An attacker can write shellcode to trigger this vulnerability...

Design/Logic Flaw

An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...

MediaWiki 安全漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and earlier...

CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...