Library exclusively intended to inject UB into safe Rust.

Quoting from the crate description: This crate is created purely to inject undefined behavior into stable, safe rust. Specifically, the inconceivable! macro is insta-UB if the ubinconceivable feature is enabled by any reverse dependency. The value this adds is questionable, and hides unsafe code...

GHSA-P75V-367R-2V23 `cell-project` used incorrect variance when projecting through `&Cell<T>`

Overview The issue lies in the implementation of the cellproject macro which used field as const instead of field as mut . The problem being that const T is covariant in T while mut T is invariant in T. Keep in mind that &Cell is invariant in T, so casting to const T relaxed the variance, and lea...

`cell-project` used incorrect variance when projecting through `&Cell<T>`

Overview The issue lies in the implementation of the cellproject macro which used field as const instead of field as mut . The problem being that const T is covariant in T while mut T is invariant in T. Keep in mind that &Cell is invariant in T, so casting to const T relaxed the variance, and lea...

macro-econom.ru Cross Site Scripting vulnerability OBB-2912853

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hackers Repeatedly Targeting Financial Services in French-Speaking African Countries

Major financial and insurance companies located in French-speaking nations in Africa have been targeted over the past two years as part of a persistent malicious campaign codenamed DangerousSavanna. Countries targeted include Ivory Coast, Morocco, Cameroon, Senegal, and Togo, with the...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A cross-site scripting vulnerability exists in XWiki Platform versions prior to 13.10.6 and prior to 14.4, which stems from the ability to store Javascript or groovy script in a...

September 6, 2022, update for Office 2013 (KB5002252)

September 6, 2022, update for Office 2013 KB5002252 This article describes update 5002252 for Microsoft Office 2013 that was released on September 6, 2022. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsof...

Hackers Hide Malware in Stunning Images Taken by James Webb Space Telescope

A persistent Golang-based malware campaign dubbed GOWEBBFUSCATOR has leveraged the deep field image taken from NASA's James Webb Space Telescope JWST as a lure to deploy malicious payloads on infected systems. The development, revealed by Securonix, points to the growing adoption of Go among thre...

Kimsuky targets South Korean entities with phishing campaign

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary As of 2010, Kimsuky has targeted the governments, think tanks, media, and education entities of the United States and South Korea. Early in 2022, a new attack cluster GoldDragon was observed targeting med...

CVE-2022-26305

An Improper Certificate Validation vulnerability was found in LibreOffice, where determining if a trusted author signed a macro was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro...

Improper Certificate Validation

libreoffice is vulnerable to an Improper Certificate Validation vulnerability. The vulnerability exists where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificat potentially...

Threat Actors Pivot Around Microsoft’s Macro-Blocking in Office

Threat actors are finding their way around Microsoft’s default blocking of macros in its Office suite, using alternative files to host malicious payloads now that a primary channel for threat delivery is being cut off, researchers have found. The use of macros-enabled attachments by threat actors...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the expandmmacro function of modules/preprocs/nasm/nasm-pp.c. Remediation There is no fixed version for yasm. References - GitHub Gist - GitHub Issue Credit: Clingto...

Vulnerabilities fixed in LibreOffice

The Document Foundation has fixed three vulnerabilities in LibreOffice. An unauthenticated remote malicious person could potentially exploit the vulnerabilities potentially exploit them to execute arbitrary macro code in the user's context, or to gain access to user passwords in the local passwor...

AZL-35375 CVE-2021-33465 affecting package yasm 1.3.0-17

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandmmacro in modules/preprocs/nasm/nasm-pp.c...

AZL-10336 CVE-2021-33466 affecting package yasm 1.3.0-17

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandsmacro in modules/preprocs/nasm/nasm-pp.c...

CVE-2021-33466

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandsmacro in modules/preprocs/nasm/nasm-pp.c...

AZL-10335 CVE-2021-33465 affecting package yasm 1.3.0-17

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandmmacro in modules/preprocs/nasm/nasm-pp.c...

UBUNTU-CVE-2021-33465

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandmmacro in modules/preprocs/nasm/nasm-pp.c...

CVE-2020-36290

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting XSS...