Internet Bug Bounty: Regexes with large repetitions on empty sub-expressions take a very long time to parse

Rust's regex crate guarantees a linear time complexity with regex length for compilation of untrusted regexes. However, existing mitigations for known malicious regexes are based on memory usage and, as such, do not mitigate repetitions of empty sub-expressions. For example, the following payload...

CVE-2021-25220

creationtimestamp| type| source ---|---|--- 2022-03-21 10:25:23+00:00| seen| https://t.me/truesecator/2751 2022-03-23 15:28:54+00:00| seen| https://t.me/cibsecurity/39402 2023-08-14 13:43:15+00:00| published-proof-of-concept| https://t.me/truesecator/4724 2025-04-15 10:00:00+00:00| seen|...

Sandworm APT Hunts for ASUS Routers with Cyclops Blink Botnet

The modular botnet known as Cyclops Blink, linked to the same advanced persistent threat APT behind the NotPetya wiper attacks, is expanding its device targeting to include ASUS routers. Further, it’s likely that the botnet’s purpose is far more sinister than the average Mirai-knockoff’s penchant...

The vulnerability of the threat detection mechanism of Microsoft Defender for IoT, related to the lack of proper validation of the user-inputted string, allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism is related to the lack of proper validation of the string entered by the user before it is used to execute system commands. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2022-25949

The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow...

CVE-2022-25949

The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow...

Stack overflow

The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow...

CVE-2022-25949

CVE-2022-25949 affects KINGSOFT Internet Security 9 Plus (kernel-mode driver kwatch3, version 2010.06.23.247). The issue is a stack-based buffer overflow triggered by crafted inputs in the driver, potentially enabling local code execution with kernel privileges and impacting system integrity/avai...

CVE-2022-25949

The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow...

Internet Bug Bounty: Use of uninitialized value of in req_parsebody method of lua_request.c

Software Versions Ubuntu - 18.04 64-bit Apache 2.4.51 - 64 bit Cause of Bug This bug is present in the reqparsebody method of luarequest.c file. Below mentioned lines of code cause this bug. cpp const char data; int i; sizet vlen = 0; sizet len = 0; if luareadbodyr, &data, aprofft &size,...

DEBIAN-CVE-2022-24761

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

Ukraine Secret Service Arrests Hacker Helping Russian Invaders

The Security Service of Ukraine SBU said it has detained a "hacker" who offered technical assistance to the invading Russian troops by providing mobile communication services inside the Ukrainian territory. The anonymous suspect is said to have broadcasted text messages to Ukrainian officials,...

Vulnerabilities fixed in BIND

The Internet Systems Consortium ISC has fixed vulnerabilities in BIND. An unauthenticated remote malicious person can exploit the exploit the vulnerabilities to perform a cache-poisoning attack or cause a denial-of-service. One of the fixed vulnerabilities has been given the attribute CVE-2022-06...

Multiple vulnerabilities in KINGSOFT "WPS Office" and "KINGSOFT Internet Security"

Overview "WPS Office" and "KINGSOFT Internet Security" provided by KINGSOFT JAPAN, INC. contain multiple vulnerabilities listed below. Stack-based buffer overflow CWE-121 - CVE-2022-25949 Insecurely loading Dynamic Link Libraries CWE-427 - CVE-2022-26081, CVE-2022-25969, CVE-2022-26511 These...

ISC BIND 安全漏洞

ISC BIND is a suite of open source software from ISC Corporation that implements the DNS protocol. A security vulnerability exists in ISC BIND, which stems from a timeout or artificially delayed fetch when tracing DS records that could cause "named" to crash when resuming a DS lookup...

The vulnerability in the implementation of the TCP/IP protocol stack for Linux-based operating systems allows a hacker to cause a service failure.

The vulnerability of the TCP/IP protocol stack implementation in Linux-based operating systems is related to errors in processing ICMPv6 packets. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

KINGSOFT Internet Security 缓冲区错误漏洞

KINGSOFT Internet Security Kingsoft AntiVirus is an anti-virus program from the Chinese company KINGSOFT. A security vulnerability exists in KINGSOFT Internet Security 9 Plus version 2010.06.23.247, which originates from the presence of a boundary error in the software that results in a stack-bas...

The vulnerability of the skb_page_frag_refill parameter in the implementation of the Linux-based operating system kernel for IPSec protocols allows a attacker to cause a service failure.

The vulnerability of the “skbpagefragrefill” parameter in the implementation of the Linux-based operating system’s IPSec kernel protocol is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

samba bug fix and enhancement update

Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines to share files, printers, and various information. Bug Fixes and Enhancements: Samba 4.14.5 - virusfiltervfsopenat: Not...

Linux kernel安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to a denial-of-service vulnerability that stems from a memory leak in the ICMPv6 network protocol stack. An attacker could exploit the vulnerability by generating and sending...