offcampushousing.unc.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007421 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

imagemagick:ping_miff_fuzzer: Heap-buffer-overflow in PushDoublePixel

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5700086448783360 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingmifffuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cras...

openh264:decoder_fuzzer: Heap-use-after-free in WelsDec::SetUnRef

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5674471365279744 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerasanopenh264 Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address:...

Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

Executive summary Kaspersky Exploit Prevention is a component part of Kaspersky products that has successfully detected a number of zero-day attacks in the past. Recently, it caught a new unknown exploit for Google's Chrome browser. We promptly reported this to the Google Chrome security team...

New Chrome 0-day Bug Under Active Attacks – Update Your Browser Now!

Attention readers, if you are using Chrome on your Windows, Mac, and Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today. With the release of Chrome 78.0.3904.87, Google is warning billions of users to install an urgent...

Tracking CVE-2019-11043 PHP Vulnerability – An Uncommon Chain of Events

On October 22, security researcher Omar Ganiev published a tweet regarding remote code execution vulnerability in PHP-FPM the FastCGI Process Manager running on the Nginx server. The tweet includes a link to a GitHub repository with an explanation of the vulnerability and a PoC proof-of-concept f...

osquery:osqueryfuzz-config: Heap-buffer-overflow in bool rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocat

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5082304661946368 Project: osquery Fuzzing Engine: libFuzzer Fuzz Target: osqueryfuzz-config Job Type: libfuzzerasanosquery Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in coolkey_v1_get_attribute_len

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=6319339464818688 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libreoffice:cgmfuzzer: Heap-buffer-overflow in CGMBitmap::ImplGetBitmap

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5640502099050496 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: cgmfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

lzo:all_lzo_compress: Use-of-uninitialized-value in do_compress

Detailed Report: https://oss-fuzz.com/testcase?key=5184581522685952 Project: lzo Fuzzing Engine: libFuzzer Fuzz Target: alllzocompress Job Type: libfuzzermsanlzo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: docompress lzo1f1compress FuzzLzoAlgorithm...

This Week in Security News: Trend Micro Launches its XDR Center in India and EU Reports 5G Cybersecurity Risks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s new XDR Center in India that will help solve data sovereignty issues. Also, read about 5G network software use bei...

Top 6 email security best practices to protect against phishing attacks and business email compromise

Most cyberattacks start over email—a user is tricked into opening a malicious attachment, or into clicking a malicious link and divulging credentials, or into responding with confidential data. Attackers dupe victims by using carefully crafted emails to build a false sense of trust and/or urgency...

APT trends report Q3 2019

For more than two years, the Global Research and Analysis Team GReAT at Kaspersky has been publishing quarterly summaries of advanced persistent threat APT activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and...

imagemagick:encoder_mvg_fuzzer: Use-of-uninitialized-value in DrawPrimitive

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5033441388658688 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

Real-Time Phishing Protections

In my previous blogs, I wrote about how phishing is no longer just an email problem, how the industrialization of phishing is being driven by the easy availability and low cost of phishing toolkits, and how current phishing defenses are being bypassed by attackers. In this post, I'm going to...

Details on Uzbekistan Government Malware: SandCat

Kaspersky has uncovered an Uzbeki hacking operation, mostly due to incompetence on the part of the government hackers. The group's lax operational security includes using the name of a military group with ties to the SSS to register a domain used in its attack infrastructure; installing Kaspersky...

radare2:ia_fuzz: Heap-buffer-overflow in r_str_utf8_codepoint

Project: https://github.com/radare/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=4886464738885632 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60200003fed2...

Apple iTunes and iCloud for Windows 0-Day Exploited in Ransomware Attacks

Watch out Windows users! The cybercriminal group behind BitPaymer and iEncrypt ransomware attacks has been found exploiting a zero-day vulnerability affecting a little-known component that comes bundled with Apple's iTunes and iCloud software for Windows to evade antivirus detection. The vulnerab...

Apple iTunes and iCloud for Windows 0-Day Exploited in Ransomware Attacks

Watch out Windows users! The cybercriminal group behind BitPaymer and iEncrypt ransomware attacks has been found exploiting a zero-day vulnerability affecting a little-known component that comes bundled with Apple's iTunes and iCloud software for Windows to evade antivirus detection. The vulnerab...

Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe vulnerabilities could allow an attacker to execute arbitrary co...