libfdk-aac/aacDecoder_DecodeFrame: Index-out-of-bounds in processDrcTime

Detailed report: https://oss-fuzz.com/testcase?key=5744919487971328 Project: libfdk-aac Fuzzer: libFuzzerlibfdk-aacaacDecoderDecodeFrame Fuzz target binary: aacDecoderDecodeFrame Job Type: libfuzzerubsanlibfdk-aac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

TP-Link Wi-Fi extender remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

WiFi extender can enlarge the WiFi signal, mainly used for large or multi-storey residential, and the router signal can not cover the family's case. The extender's principle is from the main router to get a WiFi signal, and broadcast channel other WiFi signal weak or no signal area. IBM X-Force...

imagemagick/ping_icon_fuzzer: Use-of-uninitialized-value in png_crc_finish

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5751794220662784 Project: imagemagick Fuzzer: libFuzzerimagemagickpingiconfuzzer Fuzz target binary: pingiconfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

c-ares/ares_parse_reply_fuzzer: Heap-buffer-overflow in ares_parse_aaaa_reply

Project: https://github.com/c-ares/c-ares.git Detailed report: https://oss-fuzz.com/testcase?key=5650695891451904 Project: c-ares Fuzzer: libFuzzerc-aresaresparsereplyfuzzer Fuzz target binary: aresparsereplyfuzzer Job Type: libfuzzerasanc-ares Platform Id: linux Crash Type: Heap-buffer-overflow...

Firefox Releases Critical Patch Update to Stop Ongoing Zero-Day Attacks

Important Update 21 June 2019— Mozilla on Thursday released another update Firefox version 67.0.4 to patch a second zero-day vulnerability. If you use the Firefox web browser, you need to update it right now. Mozilla earlier today released Firefox 67.0.3 and Firefox ESR 60.7.1 versions to patch a...

Firefox Releases Critical Patch Update to Stop Ongoing Zero-Day Attacks

Important Update 21 June 2019—Mozilla on Thursday released another update Firefox version 67.0.4 to patch a second zero-day vulnerability. If you use the Firefox web browser, you need to update it right now. Mozilla earlier today released Firefox 67.0.3 and Firefox ESR 60.7.1 versions to patch a...

WebLogic Server re-aeration at high risk 0 day vulnerability-a vulnerability warning-the black bar safety net

6 May 11, Ali cloud security team found WebLogic CVE-2019-2725 patch to bypass the 0day vulnerabilities, and First Time reported in Oracle official, 6 January 12, get Oracle official confirmation. Since Oracle has not yet released an official patch, vulnerability details and real PoC are not...

WordPress Count per Day Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Count per Day plugin is a plugin that counts the number of visitors to a web page. A cross-site scripting vulnerability exists in...

Uber: Arbitrary File Reading on Uber SSL VPN

The hacker has found a series of 0 day related to Pulse Secure SSL VPN...

Microsoft Word (2016) Deceptive File Reference

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product Microsoft Word 2016 Vulnerability Type...

WordPress Count per Day Plugin < 3.2.6 XSS Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2013-7472

The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpdmetaboxes daytoshow parameter...

CVE-2013-7472

The CVE-2013-7472 issue affects the WordPress Count per Day plugin prior to version 3.2.6, where an XSS vulnerability can be triggered via the daytoshow parameter in wp-admin/?page=cpd_metaboxes. Impact details in connected records indicate cross-site scripting without authentication and with use...

PolarBear

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged...

Critical Adobe Flash, ColdFusion Vulnerabilities Patched

Adobe has issued fixes for critical flaws in Adobe Flash and ColdFusion that could lead to arbitrary code execution if exploited. Overall, Adobe patched 11 vulnerabilities across Adobe Flash, Adobe ColdFusion and Adobe Campaign – including five critical flaws – during its regularly-scheduled...

Smart TV and then exposed vulnerabilities--Supra Smart Cloud TV vulnerability can cause the device to be hijacking-vulnerability warning-the black bar safety net

An attacker can take advantage of a smart TV vulnerability, the attack connected to the home router to get remote access. Supra smart TV in a not patched the vulnerability so that the same Wi-Fi network, the attacker can hijack the TV device, play their own content, such as a fake emergency...

SandboxEscaper Debuts ByeBear Windows Patch Bypass

Guerrilla developer SandboxEscaper has disclosed a second bypass exploit for a patch that fixes a Windows local privilege-escalation LPE flaw — again without notifying Microsoft. The exploit, dubbed “ByeBear,” enables attackers to get past the patch to attack a permissions-overwrite,...

This Week in Security News: Gray Alerts and Wormable Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the new wormable malware that’s dropping a Monero miner in web servers, networks and removable drivers. Also, read about the bes...

Hacker Discloses Second Zero-Day to Bypass Patch for Windows EoP Flaw

An anonymous security researcher going by the name of SandboxEscaper today publicly shared a second zero-day exploit that can be used to bypass a recently patched elevation of privilege vulnerability in the Microsoft Windows operating system. SandboxEscaper is known for publicly dropping zero-day...

Hacker Discloses Second Zero-Day to Bypass Patch for Windows EoP Flaw

An anonymous security researcher going by the name of SandboxEscaper today publicly shared a second zero-day exploit that can be used to bypass a recently patched elevation of privilege vulnerability in the Microsoft Windows operating system. SandboxEscaper is known for publicly dropping zero-day...