CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

Two Zoom Zero-Day Flaws Uncovered

UPDATE Two zero-day flaws have been uncovered in Zoom’s macOS client version, according to researchers. The web conferencing platform vulnerabilities could give local, unprivileged attackers root privileges, and allow them to access victims’ microphone and camera. As of Thursday, the two...

MGASA-2020-0149 Updated chromium-browser-stable packages fix security vulnerability

Multiple flaws were found in the way Chromium 80.0.3987.122 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. CVE-2020-6420, CVE-2020-6422, CVE-2020-6424,...

IBM Spectrum Protect Plus Arbitrarily Delete Directory Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to memory usage after it is freed. This allows attackers to execute arbitrary code.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to execute arbitrary...

Chinese Hackers Exploit Cisco, Citrix Flaws in Massive Espionage Campaign

Researchers warn that APT41, a notorious China-linked threat group, has targeted more than 75 organizations worldwide in “one of the broadest campaigns by a Chinese cyber-espionage actor observed in recent years.” Between Jan. 20 and March 11, researchers observed APT41 exploiting vulnerabilities...

Microsoft Warns of Critical Windows Zero-Day Flaws

Microsoft is warning of critical zero-day flaws in its Windows operating system that could enable remote code execution. The unpatched flaws are being exploited by attackers in “limited, targeted” attacks, the company said. According to Microsoft, two remote code execution vulnerabilities exist i...

Multiple DDoS Botnets Exploited 0-Day Flaws in LILIN DVR Surveillance Systems

Multiple zero-day vulnerabilities in digital video recorders DVRs for surveillance systems manufactured by Taiwan-based LILIN have been exploited by botnet operators to infect and co-opt vulnerable devices into a family of denial-of-service bots. The findings come from Chinese security firm Qihoo...

CVE-2020-10597

Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information and/or crash the application...

The vulnerabilities of anti-virus software programs Worry-Free Business Security, Apex One, and OfficeScan stem from insufficient validation of input data. This allows attackers to bypass content validation and manipulate the components of the client agent.

The vulnerability of anti-virus software programs such as Worry-Free Business Security, Apex One, and OfficeScan exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to bypass content validation and manipulate the client agent components...

The vulnerability of the Windows GDI component in Windows operating systems allows attackers to disclose sensitive information that is protected by security measures.

The vulnerability of Windows GDI components in Windows operating systems is related to security flaws in the system’s mechanisms. Exploiting this vulnerability allows a malicious actor to disclose protected information remotely...

CVE-2020-4203

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. IBM X-Force ID: 174956...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

The vulnerability of the File Store Service, a component of the Service Fabric application, allows a perpetrator to escalate their privileges.

The vulnerability of the File Store Service of the Service Fabric application is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to enhance their privileges by modifying the configuration file and connecting to SMB or SCP ports...

CVE-2019-13167

Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions...

Chadha Software Technologies PHPKB Standard Multi-Language Cross-Site Scripting Vulnerability (CNVD-2020-17948)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site scripting vulnerability exists in the way URIs are handled in the admin/header.php file in Chadha Software Technologies...

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge’s web browser, based on EdgeHTML, relates to memory object handling flaws, allowing an attacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge’s web browser, based on EdgeHTML, is related to memory-related object handling flaws. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the microprogrammed software of Moxa Mgate MB3180, MB3280, MB3480, MB3170, and MB3270 relates to authentication deficiencies. This allows a hacker to gain access to the system with a dummy username and password, and perform arbitrary actions on the vulnerable device.

The vulnerability of the microprogrammed software of Moxa Mgate MB3180, MB3280, MB3480, MB3170, and MB3270 relates to authentication deficiencies. Exploiting this vulnerability allows a malicious actor to gain access to the system with a dummy username and password, and perform arbitrary actions ...

The vulnerability of VBScript script handlers in the Internet Explorer web browser allows a hacker to execute arbitrary code.

The vulnerability of VBScript script handlers in the Internet Explorer web browser is related to deficiencies in object handling in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page...

The vulnerability of the Internet Explorer web browser’s script handler allows a hacker to execute arbitrary code.

The vulnerability of the Internet Explorer web browser’s script handler is related to memory-related object handling flaws. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created web page...