CVE-2020-21601

libde265 v1.0.4 contains a stack buffer overflow in the putqpelfallback function, which can be exploited via a crafted a file...

CVE-2021-40438

creationtimestamp| type| source ---|---|--- 2021-09-16 18:22:49+00:00| seen| https://t.me/cibsecurity/28988 2021-10-14 13:22:35+00:00| published-proof-of-concept| https://t.me/cKure/7605 2021-10-15 13:16:10+00:00| published-proof-of-concept| https://t.me/ptswarm/82 2021-10-15 13:37:04+00:00| seen...

Apple fixes the zero-day vulnerabilities exploited by Pegasus spyware named “FORCEDENTRY”

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Two actively exploited vulnerabilities CVE-2021-30858 and CVE-2021-30860 have been fixed in Apples iOS 14.8, iPadOS 14.8, watchOS 7.6.2, macOS Big Sur 11.6, and Safari 14.1.2 releases. The NSO group carried out the attack by...

CVE-2021-33044

creationtimestamp| type| source ---|---|--- 2021-09-16 02:22:15+00:00| seen| https://t.me/cibsecurity/28955 2021-10-11 22:13:10+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/677 2021-10-12 10:43:24+00:00| exploited| https://t.me/forensictools/381 2021-10-16 07:16:46+00:00| seen|...

Apache Struts RCE Vulnerability (S2-048) - Version Check

Apache Struts is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2021-38647

creationtimestamp| type| source ---|---|--- 2021-09-15 05:46:05+00:00| published-proof-of-concept| https://t.me/cKure/7088 2021-09-15 16:22:15+00:00| seen| https://t.me/cibsecurity/28876 2021-09-15 21:47:42+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/537 2021-09-16 05:00:00+00:0...

Microsoft Releases Patch for Actively Exploited Windows Zero-Day Vulnerability

A day after Apple and Google rolled out urgent security updates, Microsoft has pushed software fixes as part of its monthly Patch Tuesday release cycle to plug 66 security holes affecting Windows and other components such as Azure, Office, BitLocker, and Visual Studio, including an actively...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-59690)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. Microsoft HEVC Video Extensions is a remote code execution vulnerability that can be exploited by attackers to execute arbitrary code on a system...

Microsoft Windows Multiple Vulnerabilities (KB5005568)

This host is missing a critical security update according to Microsoft KB5005568 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Siemens STAR-CCM+ Viewer Out-of-Bounds Write Vulnerability

Simcenter STAR-CCM+ is a multi-physics computational fluid dynamics CFD software used to simulate products operating under real-world conditions. An out-of-bounds write vulnerability exists in Siemens STAR-CCM+ Viewer, which can be exploited by an attacker to execute code in the context of the...

Siemens SINEMA Remote Connect Server Information Disclosure Vulnerability (CNVD-2021-71422)

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens, Germany. The platform is used to remotely access, maintain, control and diagnose the underlying network. An information disclosure vulnerability exists in versions prior to Siemens SINEMA Remote Connect...

Microsoft Patches Actively Exploited Windows Zero-Day

In September’s Patch Tuesday crop of security fixes, Microsoft released patches for 66 CVEs, three of which are rated critical, and one of which – the Windows MSHTML zero-day – has been under active attack for nearly two weeks. One other bug is listed as publicly known but isn’t yet being...

Update now! Google Chrome fixes two in-the-wild zero-days

Google announced on Monday that it will be issuing patches for 11 high severity vulnerabilities found in Chrome, including two that are currently being exploited in the wild. The patch, which is part of the Stable Channel Update for Chrome 93 93.0.4577.82, will be released for Windows, Mac, and...

Pair of Google Chrome Zero-Day Bugs Actively Exploited

Google has addressed two zero-day security bugs that are being actively exploited in the wild. As part of the internet giant’s latest stable channel release version 93.0.4577.82 for Windows, Mac and Linux, it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are...

Apple Issues Urgent Updates to Fix New Zero-Day Linked to Pegasus Spyware

Apple has released iOS 14.8, iPadOS 14.8, watchOS 7.6.2, macOS Big Sur 11.6, and Safari 14.1.2 to fix two actively exploited vulnerabilities, one of which defeated extra security protections built into the operating system. The list of two flaws is as follows - CVE-2021-30858 WebKit - A use after...

Arista Networks MOS Access Control Error Vulnerability

Arista Networks MOS is a fully programmable and highly modular Linux-based network operating system from Arista Networks, Inc. that uses the familiar industry-standard CLI and runs a single binary software image in the Arista switch family. Arista Networks MOS is vulnerable to an access control...

CVE-2021-37417

creationtimestamp| type| source ---|---|--- 2021-09-10 18:38:03+00:00| exploited| https://t.me/truesecator/2092...

CVE-2021-28958

creationtimestamp| type| source ---|---|--- 2021-09-10 18:38:03+00:00| exploited| https://t.me/truesecator/2092...

Stack overflow

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS...

CVE-2021-28813 Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have...