DEBIAN-CVE-2021-42574

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and...

UBUNTU-CVE-2021-42574

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and...

CVE-2021-42574

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and...

CVE-2021-42574: Improper Control of Generation of Code

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and...

Google Chrome Type Obfuscation Vulnerability (CNVD-2021-99262)

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in V8 in versions prior to Google Chrome 95.0.4638.69. An attacker could exploit this vulnerability to potentially cause heap corruption via a crafted HTML page...

How we took part in MLSEC and (almost) won

This summer Kaspersky experts took part in the Machine Learning Security Evasion Competition MLSEC — a series of trials testing contestants ability to create and attack machine learning models. The event is comprised of two main challenges — one for attackers, and the other for defenders. The...

Google Chrome 安全漏洞

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in V8 in versions prior to Google Chrome 95.0.4638.69. An attacker could exploit this vulnerability to potentially cause heap corruption via a crafted HTML page...

Over 25% of Malicious JavaScript Is Being Obfuscated

Last year, Akamai released research on obfuscation techniques being used by cybercriminals to create malicious JavaScript. The code is unreadable, un-debuggable, and as a result, much more challenging to analyze and detect...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2021-90094)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that plain text validation messages may be overwritten on another source through the use of the reportValidi...

Mozilla Firefox 访问控制错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that plain text validation messages may be overwritten on another source through the use of the reportValidi...

New Android Malware Steals Financial Data from 378 Banking and Wallet Apps

The operators behind the BlackRock mobile malware have surfaced back with a new Android banking trojan called ERMAC that targets Poland and has its roots in the infamous Cerberus malware, according to the latest research. "The new trojan already has active distribution campaigns and is targeting...

edge.js 跨站脚本漏洞

edge.js is the Node.js template engine. edges.js versions prior to 5.3.2 have a cross-site scripting vulnerability that stems from a type obfuscation vulnerability that can be exploited to bypass input cleanup when the input to be rendered is an array, even if is used, and can be used by attacker...

Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

In this blog entry we look into a fileless campaign that used a new HCrypt variant to distribute numerous remote access trojans RATs in victim systems. This new variant also uses an updated obfuscation mechanism which we detail...

Wasmtime 代码问题漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A code issue vulnerability exists in Wasmtime that stems from Wasmtime prior to version 0.30.0 being affected by a type obfuscation vulnerability...

BoobSnail - Allows Generating Excel 4.0 XLM Macro

BoobSnail allows generating XLM Excel 4.0 macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation. Features: various infection techniques; various obfuscation techniques; translation of formulas into languages other than English; can be used as a library - you can easily...

Google Chrome Type Obfuscation Vulnerability (CNVD-2021-92834)

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in the Blink layout in versions prior to Google Chrome 93.0.4577.82. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Adobe Acrobat和Adobe Reader 代码问题漏洞

Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat is a PDF editing software developed by Adobe. Adobe Acrobat/Reader suffers from a type obfuscation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Google chrome 安全漏洞

Chrome is a simple and efficient web browsing tool developed by Google. a type obfuscation vulnerability exists in the Blink layout in versions prior to Google Chrome 93.0.4577.82. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Ragnar Locker Gang Warns Victims Not to Call the FBI

All that the FBI/ransomware negotiators/investigators do is muck things up, so we’re going to publish your stuff if you call for help, the Ragnar Locker ransomware gang announced on its darknet data-leak site. In an announcement posted this week and seen by Bleeping Computer, the ransomware...

Too Log; Didn't Read — Unknown Actor Using CLFS Log Files for Stealth

The Mandiant Advanced Practices team recently discovered a new malware family we have named PRIVATELOG and its installer, STASHLOG. In this post, we will share a novel and especially interesting technique the samples use to hide data, along with detailed analysis of both files that was performed...