Attack AI systems in Machine Learning Evasion Competition

Today, we are launching MLSEC.IO, an educational Machine Learning Security Evasion Competition MLSEC for the AI and security communities to exercise their muscle to attack critical AI systems in a realistic setting. Hosted and sponsored by Microsoft, alongside NVIDIA, CUJO AI, VM-Ray, and MRG...

Attack AI systems in Machine Learning Evasion Competition

Today, we are launching MLSEC.IO, an educational Machine Learning Security Evasion Competition MLSEC for the AI and security communities to exercise their muscle to attack critical AI systems in a realistic setting. Hosted and sponsored by Microsoft, alongside NVIDIA, CUJO AI, VM-Ray, and MRG...

Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques

Today’s cybersecurity threats continue to find ways to fly and stay under the radar. Cybercriminals use polymorphic malware because a slight change in the binary code or script could allow the said threats to avoid detection by traditional antivirus software. Threat actors customize their wares...

PT-2021-15658 · Facebook · Folly +1

Name of the Vulnerable Software and Affected Versions: folly versions prior to v2021.07.22.00 HHVM versions prior to 4.80.5 HHVM versions 4.81.0 through 4.102.1 HHVM versions 4.103.0 through 4.113.0 HHVM versions 4.114.0 through 4.118.1 Description: Passing an attacker-controlled size when creati...

Weak Password Vulnerability in Tian Yue's O&M Security Gateway (CNVD-2021-58618)

Tian Yue O&M Security Gateway Cloud Fortress Machine is a compliance control system for controlling and auditing user O&M operations in business environment. There is a weak password vulnerability in Tian Yue Operations and Maintenance Security Gateway, which can be exploited by attackers to obta...

Facebook HHVM 输入验证错误漏洞

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of PHP loading dynamic pages. Facebook HHVM is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to perform out-of-bounds writes on the heap,...

CVE-2021-2438

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM...

CVE-2021-2438

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM...

Oracle Database Server 输入验证错误漏洞

Oracle Database Server is an object-a relational database management system that provides an open, comprehensive, and integrated approach to information management. A security vulnerability exists in the Java VM component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c. An attacker...

Oracle VM VirtualBox 输入验证错误漏洞

Oracle VM VirtualBox is a virtual machine management software from Oracle Corporation. An input validation error vulnerability exists in Oracle VM VirtualBox, which arises from a failure to properly validate input data...

Linux Variant of HelloKitty Ransomware Targets VMware ESXi Servers

For the first time, researchers have publicly spotted a Linux encryptor used by the HelloKitty ransomware gang: the outfit behind the February attack on videogame developer CD Projekt Red. On Wednesday, MalwareHunterTeam disclosed its discovery of numerous Linux ELF-64 versions of the HelloKitty...

Denial of Service Vulnerability in Proficy Machine Edition fxVersaPro

General Electric GE companies are multinational corporations that provide technology and service businesses. A denial of service vulnerability exists in Proficy Machine Edition fxVersaPro, which can be exploited by an attacker to cause a null pointer dereference to occur when indexing function...

Security Bulletin: Netty Vulnerability Affects IBM Watson Machine Learning on CP4D ( CVE-2021-21290)

Summary Netty could allow a local authenticated attacker to obtain sensitive information, caused by an insecure temp file in Unix-like systems on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-21290 DESCRIPTION: Netty could allow a local authenticated attacker to obtain...

Remote code execution

Microsoft discovered a remote code execution RCE vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U...

Trickbot Malware Rebounds with Virtual-Desktop Espionage Module

The Trickbot trojan is in resurgence mode, with its operators filling out infrastructure globally and releasing an updated version of its “vncDll” module, used for monitoring and intelligence gathering, researchers said. According to an analysis this week from Bitdefender, there has been “a...

CVE-2021-0588

In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Microsoft to acquire RiskIQ to strengthen cybersecurity of digital transformation and hybrid work

Organizations are increasingly using the cloud to reimagine every facet of their business. Hybrid work has accelerated this digital transformation, and customers are challenged with the increasing sophistication and frequency of cyberattacks. Today, Microsoft is announcing that we have entered in...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48856)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from a lack of validation in tf.rawops.RaggedTensorToTensor, and can be exploited by an...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48863)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to cause a denial of service by controlling the value of the num segments...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48855)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from tf.rawops.QuantizeAndDequantizeV2 allows invalid values for the axis parameter:. No...