GPAC Project Advanced Content 缓冲区错误漏洞

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

Nimplant - A Cross-Platform Implant Written In Nim

Nimplant is a cross-platform Linux & Windows implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated...

Live555 UAF Vulnerability

Live555 is a cross-platform C open source project that provides a solution for streaming media, which implements support for standard streaming media delivery protocols such as RTP/RTCP, RTSP, SIP, etc. A security vulnerability exists in Live555, which stems from the fact that the affected produc...

Live555 Resource Management Error Vulnerability

Live555 is a cross-platform C++ open source project that provides solutions for streaming media , it implements the standard streaming media transport protocols such as RTP/RTCP, RTSP, SIP and other support. A security vulnerability exists in Live555, which stems from the affected product's...

vulkan bug fix and enhancement update

The vulkan packages contain the reference ICD loader and validation layers for Vulkan, a graphics and compute API for cross-platform access to modern GPUs. Bug Fixes and Enhancements: Rebase vulkan-loader in 8.5 BZ1952989 Rebase vulkan-headers in 8.5 BZ1952990 Rebase spirv-headers in 8.5 BZ195299...

Contiki 安全漏洞

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. A security vulnerability in Contiki 3.0, where a silently exiting Telnet server before disconnecting from the client causes connected clients to enter an infinite loop and wait forever, which can lead to...

Exiv2 Infinite Loop Vulnerability (CNVD-2021-61438)

Exiv2 is a cross-platform C library and command-line utility for managing image metadata. exiv2 0.27.4 and earlier versions are vulnerable to an infinite loop. An attacker could exploit the vulnerability via specially crafted image files to cause a denial of service...

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and *nix Systems? | McAfee Blogs

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and nix Systems? Thibault Seret · JUL 28, 2021 Co-written with Northwave’s Noël Keijzer. Executive Summary For a long time, ransomware gangs were mostly focused on Microsoft Windows operating systems. Yes, we observed the...

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and *nix Systems? | McAfee Blogs

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and nix Systems? Thibault Seret · JUL 28, 2021 Co-written with Northwave’s Noël Keijzer. Executive Summary For a long time, ransomware gangs were mostly focused on Microsoft Windows operating systems. Yes, we observed the...

VideoLAN VLC Buffer Overflow Vulnerability (CNVD-2021-62884)

VideoLAN VLC is an open source cross-platform multimedia player and framework that can play most multimedia files, as well as DVDs, audio CDs, VCDs, and various streaming protocols. a buffer overflow vulnerability exists in the AVIExtractSubtitle component of VideoLAN VLC version 3.0.11, which ca...

SDL 2: Multiple vulnerabilities

Background Simple DirectMedia Layer is a cross-platform development library designed to provide low level access to audio, keyboard, mouse, joystick, and graphics hardware via OpenGL and Direct3D. Description Multiple vulnerabilities have been discovered in SDL 2. Please review the CVE identifier...

Foxit PDF SDK For Web Cross-Site Scripting Vulnerability

Foxit PDF SDK For Web is a cross-platform PDF solution for quickly displaying, annotating, completing, signing, and managing PDF documents in a web browser on desktop and mobile devices. A security vulnerability exists in Foxit PDF SDK For Web, which stems from If a victim uploads a malicious PDF...

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

Note: In this two-part blog series, we expose a modern malware infrastructure and provide guidance for protecting against the wide range of threats it enables. Part 1 covers the evolution of the threat, how it spreads, and how it impacts organizations. Part 2 is a deep dive on the attacker behavi...

Oracle VM VirtualBox Unauthorized Access Vulnerability (CNVD-2021-54712)

Oracle VM VirtualBox is a cross-platform virtualization software for x86 systems. A security vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.24. An attacker could use this vulnerability to gain unauthorized read access to a portion of the product-accessibl...

SeaCMS suffers from SQL injection vulnerabilities (CNVD-2021-54018)

SeaCMS is a PHP MYSQL-based architecture, professional open source free PHP film and television system, can be cross-platform operation of the web content management system. SeaCMS SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive database information...

The vulnerability of the read_xbm_body function in cross-platform Qt IDEs, related to reading data beyond the buffer’s acceptable limits, allows attackers to cause service failures.

The vulnerability of the readxbmbody function in cross-platform Qt IDEs is related to reading data beyond the allowable buffer size. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

purple-team-attack-automation

This is an offensive tool for Metasploit Framework. The tool is designed to automate the process of exploiting vulnerabilities in various systems. It is likely used for penetration testing and vulnerability assessment purposes. The tool is written in Ruby and utilizes the Metasploit Framework,...

The vulnerability of the qsvghandler.cpp component of the cross-platform development framework for Qt software, related to the lack of a mechanism for checking input data, allows attackers to trigger service failures.

The vulnerability of the qsvghandler.cpp component of the cross-platform framework for developing Qt software is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to trigger a service failure by using an altered SVG image...

SQL Injection Vulnerability in SEACMS (CNVD-2021-51344)

SEACMS is a web content management system based on PHP MYSQL architecture and can run across platforms. SEACMS has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

Microsoft Urges Azure Users to Update PowerShell to Patch RCE Flaw

Microsoft is urging Azure users to update the PowerShell command-line tool as soon as possible to protect against a critical remote code execution vulnerability impacting .NET Core. The issue, tracked as CVE-2021-26701 CVSS score: 8.1, affects PowerShell versions 7.0 and 7.1 and have been...