CVE-2020-15211: Out-of-bounds Read

In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indice...

CVE-2020-26088

A missing capabilities check when creating NFC raw sockets could be used by local attackers to create raw sockets, bypassing security mechanisms allowing them to create or listen to NFC communication frames. Mitigation As the nfc module will be auto-loaded when required, its use can be disabled b...

USN-4535-1: RDFLib vulnerability

Gabriel Corona discovered that RDFLib did not properly load modules on the command-line. An attacker could possibly use this issue to cause RDFLib to execute arbitrary code. CVE-2019-7653...

USN-4535-1 rdflib vulnerability

Gabriel Corona discovered that RDFLib did not properly load modules on the command-line. An attacker could possibly use this issue to cause RDFLib to execute arbitrary code. CVE-2019-7653...

Microsoft SharePoint Server Code Execution

The vulnerability of the Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server packages relates to the loading of code without checking its integrity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

UPDATE: Empire v3.4.0

Empire v3.4.0 was released a couple of days ago! I briefly mentioned about this tool in my old post titled - List of Open Source C2 Post-Exploitation Frameworks. This new version brings support for Malleable C2 listeners and reflective file loading among other bug fixes. What is Empire? Empire 3....

Security Bulletin: Improper DLL loading vulnerability affecting Aspera Connect 3.9.9 and earlier

Summary IBM Aspera Connect could allow a local attacker to execute arbitrary code on the Windows system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execut...

CVE-2020-15704

A flaw in the Linux ppp daemon functionality was found in the way possibility of unexpected loading pppgeneric module during ppp daemon startup...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-1384)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.2.0 ESR - Fixed: Various stability, functionality, and security fixes - Mozilla Firefox ESR 78.2 MFSA 2020-38 bsc1175686 - CVE-2020-15663 bmo1643199 Downgrade attack on the Mozilla Maintenance Servic...

OPENSUSE-SU-2020:1391-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.2.0 ESR Fixed: Various stability, functionality, and security fixes - Mozilla Firefox ESR 78.2 MFSA 2020-38 bsc1175686 CVE-2020-15663 bmo1643199 Downgrade attack on the Mozilla Maintenance Service cou...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:2544-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.2.0 ESR - Fixed: Various stability, functionality, and security fixes Mozilla Firefox ESR 78.2 MFSA 2020-38 bsc1175686 - CVE-2020-15663 bmo1643199 Downgrade attack on the Mozilla Maintenance Service...

Security update for MozillaFirefox (moderate)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2020:1384-1 Rating: moderate References: 1173991 1174284 1175686 Cross-References: CVE-2020-15663 CVE-2020-15664 CVE-2020-15670 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilitie...

SUSE-SU-2020:2563-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.2.0 ESR Fixed: Various stability, functionality, and security fixes - Mozilla Firefox ESR 78.2 MFSA 2020-38 bsc1175686 CVE-2020-15663 bmo1643199 Downgrade attack on the Mozilla Maintenance Service cou...

Visa warns of Baka JavaScript skimmer capable of evading detection

By Deeba Ahmed The JavaScript skimmer evades detection from static malware scanners using dynamic loading. This is a post from HackRead.com Read the original post: Visa warns of Baka JavaScript skimmer capable of evading detection...

CVE-2020-4545

IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitra...

PT-2020-18122

Name of the Vulnerable Software and Affected Versions IBM Aspera Connect version 3.9.9 Description The issue is caused by improper loading of Dynamic Link Libraries by the import feature, allowing a remote attacker to execute arbitrary code on the system. An attacker could exploit this by...

CVE-2020-1890

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

PT-2020-15146

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.20.11 WhatsApp Business for Android versions prior to 2.20.2 Description A URL validation issue could cause the recipient of a sticker message with deliberately malformed data to load an image from a...

CVE-2020-1890: Improper Input Validation

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...