4312 matches found
CVE-2021-41098
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are...
PT-2021-23087
Name of the Vulnerable Software and Affected Versions Nokogiri versions 1.12.4 and earlier Description Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri, on JRuby only, the SAX parser resolves external entities by default. Users of...
CVE-2021-21238
A verification flaw was found in python-pysaml2, where it did not validate signed SAML documents against an XML schema. Because the flaw allowed invalid XML documents to be processed, a network attacker could exploit this flaw by tricking pysaml2 with a wrapped signature. Mitigation Mitigation fo...
Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs
By Asheer Malhotra, Vanja Svajcer and Justin Thattil. Cisco Talos is tracking a campaign targeting government personnel in India using themes and tactics similar to APT36 aka Mythic Leopard and Transparent Tribe.This campaign distributes malicious documents and archives to deliver the Netwire...
CVE-2021-33035
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the...
CVE-2021-33035
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the...
Apple tvOS 缓冲区错误漏洞
Apple tvOS is a set of smart TV operating systems from Apple USA. A buffer error vulnerability exists in Apple TV 4K and Apple TV HD, which stems from a boundary error when processing font files in FontParser. The vulnerability can be exploited to trick a victim into opening a specially crafted...
Apple TV app 缓冲区错误漏洞
The Apple TV app is a television application from Apple USA. A buffer error vulnerability exists in Apple TV 4K and Apple TV HD, which stems from a boundary error when processing font files in FontParser. An attacker could use this vulnerability to trick a victim into opening a specially crafted...
Windows MSHTML 0-Day Exploited to Deploy Cobalt Strike Beacon in Targeted Attacks
Microsoft on Wednesday disclosed details of a targeted phishing campaign that leveraged a now-patched zero-day flaw in its MSHTML platform using specially-crafted Office documents to deploy Cobalt Strike Beacon on compromised Windows systems. "These attacks used the vulnerability, tracked as...
Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability
In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...
CVE-2021-40444
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious Active...
CVE-2021-40444
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious Active...
Update 17.10 for Microsoft Dynamics 365 Business Central 2020 Release Wave 2 (Application Build 17.10.29463, Platform Build 17.0.29460): September 14, 2021 (KB5006075)
None None...
PT-2021-4928 · Adobe · Acrobat Reader
Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader DC versions 2021.005.20060 and earlier Adobe Acrobat Reader DC versions 2020.004.30006 and earlier Adobe Acrobat Reader DC versions 2017.011.30199 and earlier Description: The issue is related to a Buffer Overflow...
LA Police Are Collecting Detainees' Social Media Information
According to new documents, officers ask people they stop for their Facebook and Twitter account details, and then feed the data into Palantir...
Ubuntu: Security Advisory (USN-5066-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5066-2: PySAML2 vulnerability
USN-5066-1 fixed a vulnerability in PySAML2. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Brian Wolff discovered that PySAML2 incorrectly validated cryptographic signatures. A remote attacker could possibly use this issue to alter SAML documents...
USN-5066-2 python-pysaml2 vulnerability
USN-5066-1 fixed a vulnerability in PySAML2. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Brian Wolff discovered that PySAML2 incorrectly validated cryptographic signatures. A remote attacker could possibly use this issue to alter SAML documents...
Microsoft, CISA Urge Mitigations for Zero-Day RCE Flaw in Windows
Both Microsoft and federal cybersecurity officials are urging organizations to use mitigations to combat a zero-day remote control execution RCE vulnerability in Windows that allows attackers to craft malicious Microsoft Office documents. Microsoft has not revealed much about the MSHTML bug,...