Multiple Mitsubishi Electric Products Inject Vulnerabilities

Mitsubishi Electric GT27 and others are a GOT2000 series graphic operation terminal from Mitsubishi Electric Japan. An injection vulnerability exists in CoreOS Y and prior versions in the Mitsubishi Electric GT27, GT25, and GT23 GOT2000 series, which can be exploited by an attacker to cause a...

Multiple Mitsubishi Electric Products Resource Management Error Vulnerability (CNVD-2020-46798)

Mitsubishi Electric GT27 and others are a GOT2000 series graphic operation terminal from Mitsubishi Electric Japan. A resource management error vulnerability exists in CoreOS Y and prior versions in the Mitsubishi Electric GT27, GT25, and GT23 GOT2000 series, which can be exploited by an attacker...

kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c

A use-after-free flaw was found in the Linux kernel’s ext4 file system functionality when the user mount ext4 partition, with the usage of an additional debug parameter is defining an extra inode size. If this parameter has a non zero value, this flaw allows a local user to crash the system when...

CVE-2020-15529

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks...

E.U. Authorities Crack Encryption of Massive Criminal and Murder Network

European law-enforcement officials have shut down an encrypted Android-based communications platform used exclusively by criminals to plot murders, traffic illegal drugs, commit money laundering and plan other organized crimes. An international law-enforcement team from the France and the...

Police Arrested Hundreds of Criminals After Hacking Into Encrypted Chat Network

In a joint operation, European and British law enforcement agencies recently arrested hundreds of alleged drug dealers and other criminals after infiltrating into a global network of an encrypted chatting app that was used to plot drug deals, money laundering, extortions, and even murders. Dubbed...

NVIDIA Virtual GPU Manager vGPU Input Validation Error Vulnerability (CNVD-2021-27720)

NVIDIA Virtual GPU Manager is an NVIDIA virtual GPU management software from NVIDIA. vGPU is one of the virtual FPU components. An input validation error vulnerability exists in NVIDIA Virtual GPU Manager, which stems from the vGPU plug-in not validating the size of input data, and can be exploit...

DEBIAN-CVE-2020-15396

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root...

UBUNTU-CVE-2020-15396

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root...

The vulnerability of the Microsoft Internet Information Server (IIS) server allows for unauthorized access by attackers, enabling them to escalate their privileges. This vulnerability is related to the Windows Background Intelligent Transfer Service (BITS), which operates on Windows operating systems.

The vulnerability of the Microsoft Internet Information Server IIS server, due to the Windows Background Intelligent Transfer Service BITS, affects operating systems running on Windows. This vulnerability is related to file operation processing errors. Exploiting this vulnerability can allow an...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4404-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4404-2 advisory. USN-4404-1 fixed vulnerabilities in the NVIDIA graphics drivers. This update provides the corresponding updates for the NVIDIA Linux DKMS...

USN-4404-1: NVIDIA graphics drivers vulnerabilities

Thomas E. Carroll discovered that the NVIDIA Cuda grpahics driver did not properly perform access control when performing IPC. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2020-5963 It was discovered that the UVM driver in the NVIDIA graphics...

CVE-2020-6870

The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...

Key Elements for DDoS Detection, Mitigation and Analysis

Given today’s volatile DDoS threat landscape with attacks ranging from massive volumetric assaults to sophisticated and persistent application level threats, comprehensive protection is a must for online businesses. But what are the most important considerations for evaluating potential solutions...

OSV-2020-201 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22453 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

CVE-2020-14462

CALDERA 2.7.0 allows XSS via the Operation Name box...

CVE-2020-14462

CALDERA 2.7.0 allows XSS via the Operation Name box...

Cross site scripting

CALDERA 2.7.0 allows XSS via the Operation Name box...

CVE-2020-14462

CALDERA 2.7.0 allows XSS via the Operation Name box...

LinkedIn 'Job Offers' Targeted Aerospace, Military Firms With Malware

Attackers are impersonating human resource employees from Collins Aerospace and General Dynamics in a spear-phishing campaign leveraging LinkedIn’s messaging service. Targets are sent phony job offers that include malicious documents designed to fetch data-exfiltrating malware. The spear-phishing...