CVE-2021-21417

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file...

Design/Logic Flaw

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file...

CVE-2021-21417

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file...

wasm3:fuzzer: Segv on unknown address in InitElements

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5640877520322560 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzermsanwasm3 Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: InitElements...

Chinese Hackers Attacking Military Organizations With New Backdoor

Bad actors with suspected ties to China have been behind a wide-ranging cyberespionage campaign targeting military organizations in Southeast Asia for nearly two years, according to new research. Attributing the attacks to a threat actor dubbed "Naikon APT," cybersecurity firm Bitdefender laid ou...

fluidsynth 资源管理错误漏洞

fluidsynth is an application system. for generating audio by reading and processing MIDI events from MIDI input devices using SoundFont. A resource management error vulnerability exists in fluidsynth, which stems from use after a free conflict was discovered, and may be triggered when loading an...

poppler:qt_pdf_fuzzer: Use-of-uninitialized-value in _bdf_readstream

Detailed Report: https://oss-fuzz.com/testcase?key=5966568824635392 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: qtpdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bdfreadstream bdfloadfont BDFFaceInit...

Code injection

A vulnerability has been identified in LOGO! Soft Comfort All versions V8.4. The software insecurely loads libraries which makes it vulnerable to DLL hijacking. Successful exploitation by a local attacker could lead to a takeover of the system where the software is installed...

wasm3:fuzzer: Heap-buffer-overflow in op_Const64

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5015159715266560 Project: wasm3 Fuzzing Engine: honggfuzz Fuzz Target: fuzzer Job Type: honggfuzzasanwasm3 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x60d0000000d0 Crash...

SAP NetWeaver Knowledge Management Access Modification Inaccessible

The vulnerability of the Knowledge Management component of the SAP NetWeaver software integration platform is related to the absence of restrictions on file loading. Exploiting this vulnerability allows a malicious actor to remotely gain access, modify, or make existing files inaccessible using a...

Cisco IOS XE Malicious Code Execution

The vulnerability of the check function for the image of Microprogramming Software in Cisco IOS XE network devices of the Cisco Catalyst 9000 series is related to improper checking of the cryptographic signature. Exploiting this vulnerability can allow a perpetrator to load malicious software or...

PT-2021-6927

Name of the Vulnerable Software and Affected Versions Elcomplus SmartPTT affected versions not specified Description The issue is related to the unlimited upload of dangerous file types in the update loading function of the scada-server. This could allow a remote attacker to execute arbitrary cod...

Targeted Malware Reverse Engineering Workshop follow-up. Part 1

On April 8, 2021, we conducted a webinar with Ivan Kwiatkowski and Denis Legezo, Senior Security Researchers from our Global Research & Analysis Team GReAT, who gave live workshops on practical disassembling, decrypting and deobfuscating authentic malware cases, moderated by GReATs own Dan Demete...

SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1240-1)

This update for qemu fixes the following issues : Fix OOB access in sm501 device emulation CVE-2020-12829, bsc1172385 Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation CVE-2020-13362 bsc1172383 Fix use-after-free in usb xhci packet handling CVE-2020-25723, bsc1178934 Fix use-after-free...

SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1241-1)

This update for qemu fixes the following issues : Fix OOB access in sm501 device emulation CVE-2020-12829, bsc1172385 Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation CVE-2020-13362, bsc1172383 Fix use-after-free in usb xhci packet handling CVE-2020-25723, bsc1178934 Fix use-after-fre...

wasm3:fuzzer: Crash in m3_Realloc

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5044768968146944 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000003ff7 Crash State: m3Reall...

pocsuite3

This is a Python package called pocsuite3 that provides a framework for remote vulnerability testing and proof-of-concept development. It is designed to be used by penetration testers and security researchers. The package has a powerful proof-of-concept engine and comes with many features,...

CVE-2021-30209

Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions...

CVE-2020-36322

A denial of service flaw was found in fusedogetattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system. Mitigation As the FUSE module will be auto-loaded when required, its use can be disabled by preventing the modu...

Who has the fastest F1 website in 2021? Part 8

This is part 8 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...