CVE-2024-24254

PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and missionfeasibilitychecker.cpp. This will result in the drone uploading overlapping geofences and mission routes...

PT-2024-20326 · Unknown · Px4-Autopilot

Name of the Vulnerable Software and Affected Versions: PX4 Autopilot versions 1.14 and earlier Description: A Race Condition was discovered in geofence.cpp and mission feasibility checker.cpp that allows attackers to send drones on unintended missions. Recommendations: For PX4 Autopilot versions...

CVE-2024-24254

CVE-2024-24254 affects PX4 Autopilot versions 1.14 and earlier. A race condition arises from the lack of synchronization when loading geofence data in geofence.cpp and mission_feasibility_checker.cpp, which can cause the drone to upload overlapping geofences and mission routes. The connected docu...

Netflix MH370: The plane that wasn’t hacked

I’m a sucker for a good documentary, but the recent Netflix MH370 piece had me shouting at the screen. The first episode talks about the most widely accepted theory; a pilot-created murder-suicide. However, the second episode goes off the rails, discussing Russian special operations hacking the...

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks. It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct...

CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

Podcast: Insider Attacks May Soon Cost Less Than Malware-based Equivalent

As it becomes more difficult and expensive to infiltrate environments via malware, cybercriminals may start turning in the future to a more viable and less costly alternative: Insider threats. This podcast is brought to you by Code42. Threatpost talks to Tim Brown, vice president of security at...

The Threat of Fake Academic Research

Interesting analysis of the possibility, feasibility, and efficacy of deliberately fake scientific research, something I had previously speculated about...

CVE-2017-9282

An integer overflow CWE-190 led to an out-of-bounds write CWE-787 on a heap-allocated area, leading to heap corruption in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed...

Design/Logic Flaw

An out-of-bounds read CWE-125 vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed...

Gratipay: Certificate signed using SHA-1

Hello, I detected a certificate signed using SHA-1. SHA-1 is a hash algorithm used in digital signatures. It is currently considered deprecated due to the increasing feasibility in breaking it. Impact: Certificates can be forged by capable adversaries. Forged certificates can be used in MITM...

Using symbolic execution to solve a tiny ASCII maze.

In this post we'll exercise the symbolic execution engine KLEE over a funny ASCII Maze yet another toy example! | VS. | Maze dimensions: 11x7 Player pos: 1x1 Iteration no. 0 Program the player moves with a sequence of 'w', 's', 'a' or 'd' Try to reach the prize! +-+---+---+ |X| || | | --+ | | | |...

Microsoft Patch Bulletin Feasibility Check

Using credentials supplied in the scan policy, Nessus is able to collect information about the software and patches installed on the remote Windows host and will use that information to check for missing Microsoft security updates. Note that this plugin is purely informational. C Tenable Network...

EC Considering Cybercrime Division

European ministers are considering establishing a new agency that would tie together law enforcement agencies and other entities dedicated to fighting cybercrime. The Council of the European Union, composed of ministers from 27 countries, issued a document earlier this week calling for the Europe...

PT-2007-2856 · Conga · Conga

Name of the Vulnerable Software and Affected Versions: conga affected versions not specified Description: The issue concerns the luci server component in conga, where the password is preserved between page loads for the Add System/Cluster task flow. This is done by storing the password in the Val...

Sql injection

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

Microsoft Internet Explorer 5.0.1 - OuterHTML redirection Handling Information Disclosure

Microsoft Internet Explorer 5.0.1 - OuterHTML redirection Handling Information Disclosure source: https://www.securityfocus.com/bid/18682/info Microsoft Internet Explorer is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain policies. This issue may...

Microsoft Internet Explorer 5.0.1 - OuterHTML redirection Handling Information Disclosure

source: https://www.securityfocus.com/bid/18682/info Microsoft Internet Explorer is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain policies. This issue may allow attackers to access arbitrary websites in the context of a targeted user's browser...

Black Watch Labs Vulnerability Alert

Dear Security Professional, The following vulnerability: "Environment and setup variables can be viewed through FormMail script" is in the text of the message below and has just been posted to the Black Watch Labs Web site at http://www.perfectotech.com/blackwatchlabs/ Thank you, Black Watch Labs...