UBUNTU-CVE-2020-36465

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...

Code injection

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

CVE-2021-38196

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

CVE-2020-36465

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...

CVE-2020-36465

The CVE-2020-36465 issue affects the Rust generic-array crate before 0.13.3. The root cause is a soundness problem caused by using the arr! macro to extend lifetimes. This aligns with multiple sources describing a memory-safety/soundness vulnerability in generic-array (pre-0.13.3). The connected ...

CVE-2020-36465

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...

CVE-2021-38196

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

CVE-2021-38196

CVE-2021-38196 relates to the Rust crate better-macro , where a deliberate RCE via proc-macros was demonstrated through 2021-07-22. The connected documents confirm remote code execution potential and a purposefully malicious context, with coverage across RustSec, GHSA, OSV, and national advisorie...

CVE-2020-36465: Undefined Security Weakness

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...

CVE-2021-38196: Improper Control of Generation of Code

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

Rust 代码注入漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A code execution vulnerability exists in Mozilla Rust's Better-macro crate, which can be exploited by attackers to execute arbitrary code on a system...

Improper Input Validation in Centreon Web

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings...

GHSA-4F26-V6FR-9HMP Improper Input Validation in Centreon Web

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings...

RUSTSEC-2021-0077 `better-macro` has deliberate RCE to prove a point

better-macro is a fake crate which is "Proving A Point" that proc-macros can run arbitrary code. This is not a particularly novel or interesting observation. It currently opens https://github.com/raycar5/better-macro/blob/master/doc/hi.md which doesn't appear to have any malicious content, but...

PT-2021-22004

Name of the Vulnerable Software and Affected Versions: better-macro crate through 2021-07-22 Description: The issue allows remote attackers to execute arbitrary code via proc-macros. The better-macro crate has no legitimate purpose and is intended to demonstrate this capability. It opens a URL,...

A week in security (July 12 – July 18)

Last week on Malwarebytes Labs: DNS-over-HTTPS takes another small step towards global domination Nope, that isn’t Elon Musk, and he isn’t offering a free Topmist Dust watch either Four in-the-wild exploits, 13 critical patches headline bumper Patch Tuesday Is crypto’s criminal rollercoaster...

Microsoft Office Users Face Malware-Protection Bypass

Legacy users of Microsoft Excel are being targeted in a malware campaign that uses a novel malware-obfuscation technique to disable Office defenses and deliver the Zloader trojan. The attack, according to research published Thursday by McAfee, marries functions in Microsoft Office Word and Excel ...

Hackers disabling Macro security warnings in new malspam campaign

By Waqas This means hackers are downloading/executing malicious DLLs/ZLoader without any malicious code in the spammed attachment macro. This is a post from HackRead.com Read the original post: Hackers disabling Macro security warnings in new malspam campaign...

Lazarus Targets Job-Seeking Engineers with Malicious Documents

The notorious Lazarus advanced persistent threat APT group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. The ploy involves impersonating defense contractors seeking job candidates. Researchers have been tracking Lazarus activity for...

Hackers Use New Trick to Disable Macro Security Warnings in Malicious Office Files

While it's a norm for phishing campaigns that distribute weaponized Microsoft Office documents to prompt victims to enable macros in order to trigger the infection chain directly, new findings indicate attackers are using non-malicious documents to disable security warnings prior to executing mac...