fio:fuzz_parseini: Heap-use-after-free in opt_cmp

Detailed Report: https://oss-fuzz.com/testcase?key=5175641173524480 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x606000000200 Crash State: optcmp sortoptions fiooptionsparse Sanitizer:...

Vulnerabilities fixed in Juniper Junos OS

Juniper has fixed vulnerabilities in Junos OS. The vulnerabilities allow a remote malicious person to to bypass a security measure and to cause a denial-of-service cause. Juniper categorizes these vulnerabilities according to the CVSSv3 method with a highest score of 8.8. Juniper has released...

High-Severity Cisco Flaw Found in CMX Software For Retailers

A high-severity flaw in Cisco’s smart Wi-Fi solution for retailers could allow a remote attacker to alter the password of any account user on affected systems. The vulnerability is part of a number of patches issued by Cisco addressing 67 high-severity CVEs on Wednesday. This included flaws found...

[ASA-202101-19] nvidia-utils: multiple issues

Arch Linux Security Advisory ASA-202101-19 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2021-1052 CVE-2021-1053 CVE-2021-1056 Package : nvidia-utils Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1417 Summary ======= The...

Nvidia Warns Windows Gamers of High-Severity Graphics Driver Flaws

Nvidia, which makes gaming-friendly graphics processing units GPUs, on Thursday fixed a slew of high-severity flaws affecting its graphics driver. The vulnerabilities allow bad actors to cripple systems with denial of service attacks, escalate privileges, tamper with data or sniff out sensitive...

Cybercriminals Ramp Up Exploits Against Serious Zyxel Flaw

Security experts are warning hackers are ramping up attempts to exploit a high-severity vulnerability that may still reside in over 100,000 Zyxel Communications products. Zyxel, a Taiwanese manufacturer of networking devices, on Dec. 23 warned of the flaw in its firmware CVE-2020-29583 and releas...

Philips Hue Denial Of Service Vulnerability

Credits: Ilia Shnaidman + @0x496c on Twitter + https://www.iliashn.com Vendor: ============= Philips Lighting Holding B.V Product: ============= Philips Hue Hub - all Vulnerability Type: ====================== Denial of Service Security Issue: =============== Philips Hue is vulnerable to Denial...

Philips Hue Denial Of Service

Credits: Ilia Shnaidman + @0x496c on Twitter + https://www.iliashn.com Vendor: ============= Philips Lighting Holding B.V Product: ============= Philips Hue Hub - all Vulnerability Type: ====================== Denial of Service Security Issue: =============== Philips Hue is vulnerable to Denial...

mysql-connector-java: privilege escalation in MySQL connector

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/J. Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise...

Easy WP SMTP Security Bug Can Reveal Admin Credentials

Easy WP SMTP, a WordPress plugin for email management that has more than 500,000 installations, has a vulnerability that could open the site up to takeover, researchers said. Easy WP SMTP allows users to configure and send all outgoing emails via a SMTP server, so that they don’t end up in the...

Firefox Patches Critical Mystery Bug, Also Impacting Google Chrome

A Mozilla Foundation update to the Firefox web browser, released Tuesday, tackles one critical vulnerability and a handful of high-severity bugs. The update, released as Firefox version 84, is also billed by Mozilla as boosting the browser’s performance and adding native support for macOS hardwar...

BigtreeCMS 4.4.11 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerability in BigtreeCMS Affected Software: BigtreeCMS Affected Versions: 4.4.11 Vendor Homepage: https://www.bigtreecms.org/ Vulnerability Type: Cross-Site Scripting Severity: Important Status: Fixed CVE-ID:...

Design/Logic Flaw

Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserve...

VestaCP 0.9.8-26 - 'backup' Information Disclosure

Exploit Title: VestaCP 0.9.8-26 - 'backup' Information Disclosure Date: 2020-11-25 Exploit Author: Vulnerability-Lab Vendor Homepage: https://vestacp.com/ Software Link: https://vestacp.com/install/ Version: 0.9.8-26 Document Title: =============== VestaCP v0.9.8-26 - Insufficient Session...

Vulnerabilities fixed in SAP products

Vulnerabilities have been fixed in several SAP products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Bypassing authentication. Remote code execution Administrator/Root rights Spoofing Access to system data...

QNAP High-Severity Flaws Plague NAS Systems

QNAP Systems is warning of high-severity flaws that plague its top-selling network attached storage NAS devices. If exploited, the most severe of the flaws could allow attackers to remotely take over NAS devices. NAS devices are systems that consist of one or more hard drives that are constantly...

VestaCP 0.9.8-26 Token Session

Document Title: =============== VestaCP v0.9.8-26 - LoginAs Token Session Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2240 Release Date: ============= 2020-11-26 Vulnerability Laboratory ID VL-ID: ====================================...

Google Play Apps Remain Vulnerable to High-Severity Flaw

UPDATE Researchers are warning that several popular Google Play applications – including mobile browser app Edge – have yet to push out an important update addressing a high-severity vulnerability in the Google Play Core Library. The vulnerability exists in Google Play Core Library, which is...

GHSA-M7MF-48HP-5QMR Inappropriate implementation in V8

CVE-2020-16009: Inappropriate implementation in V8 - https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html - https://vulners.com/cve/CVE-2020-16009 Google is aware of reports that exploits for CVE-2020-16009 exist in the wild. Allowed a remote attacker to potentiall...

Inappropriate implementation in V8 in CefSharp

High CVE-2020-16013: Inappropriate implementation in V8. - https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop11.html - https://vulners.com/cve/CVE-2020-16013 Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild. There is...