Lazarus Targets Job-Seeking Engineers with Malicious Documents

The notorious Lazarus advanced persistent threat APT group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. The ploy involves impersonating defense contractors seeking job candidates. Researchers have been tracking Lazarus activity for...

CVE-2021-31447

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2021-29239

CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity...

Design/Logic Flaw

CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity...

CVE-2021-29239

CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity...

3s-smart Software Solutions CODESYS Development System 数据伪造问题漏洞

3s-smart Software Solutions CODESYS Development System is a suite of programming tools for the field of industrial controllers and automation technology from 3S-Smart Software Solutions 3s-smart Software Solutions, Germany. A security vulnerability exists in CODESYS Development System prior to...

CVE-2021-27271

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Misinterpretation of malicious XML input

Overview Impact xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. Workarounds...

Misinterpretation of malicious XML input

Impact xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. Patches Update to 0.5...

Input validation

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpect...

CVE-2021-21366 Misinterpretation of malicious XML input

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpect...

PT-2021-14448 · Xmldom +2 · Xmldom +2

Name of the Vulnerable Software and Affected Versions: xmldom versions 0.4.0 and older Description: The issue arises when xmldom versions 0.4.0 and older fail to correctly preserve system identifiers, FPIs, or namespaces when repeatedly parsing and serializing maliciously crafted documents. This...

Extreme Office 2019 suffers from a memory corruption vulnerability (CNVD-2021-08502)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. The latest version of Extreme Office 2019 suffers from a memory corruption vulnerability when dealing with maliciously constructed doc files, which can be exploited by an...

Design/Logic Flaw

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the documen...

Threat Source newsletter for Sept. 3, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We recently uncovered a series of email campaigns utilizing links to malicious documents hosted on legitimate file-sharing platforms to spread malware. The campaigns distributed various malware payloads including Gozi ISFB, ZLoade...

Salfram: Robbing the place without removing your name tag

By Holger Unterbrink and Edmund Brumaghin. Threat summary Cisco Talos recently uncovered a series of email campaigns utilizing links to malicious documents hosted on legitimate file-sharing platforms to spread malware.The campaigns distributed various malware payloads including Gozi ISFB, ZLoader...

Vulnerabilities fixed in Microsoft browsers

Microsoft has fixed several vulnerabilities in Internet Explorer and Edge. All of the vulnerabilities allow a malicious person to able to execute arbitrary code in the context of the user when he manages to trick the user into opening a malicious Web site or document to open. Below is an overview...

Debian DLA-2287-1 : poppler security update

Several issues were found in Poppler, a PDF rendering library, that could lead to denial of service or possibly other unspecified impact when processing maliciously crafted documents. For Debian 9 stretch, these problems have been fixed in version 0.48.0-2+deb9u3. We recommend that you upgrade yo...

Microsoft Windows GDI Information Disclosure Vulnerability (CNVD-2021-24907)

Microsoft Windows is a set of operating systems for personal devices from Microsoft.Windows Graphics Device Interface GDI is one of the graphic device interfaces. An information disclosure vulnerability exists in the Microsoft Windows GDI component. An attacker could exploit this vulnerability by...

‘Coronavirus Report’ Emails Spread NetSupport RAT, Microsoft Warns

A recent spear-phishing campaign has been spotted spreading a weaponized NetSupport Manager remote access tool RAT, which is a legitimate tool used for troubleshooting and tech support. Attackers use the ongoing coronavirus pandemic as a lure, as well as malicious Excel documents, to convince...