Design/Logic Flaw

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

CVE-2020-17487

CVE-2020-17487 affects radare2 4.5.0 and causes a segmentation fault in r_x509_parse_algorithmidentifier due to a malformed OBJECT IDENTIFIER in IMAGE_DIRECTORY_ENTRY_SECURITY while parsing PE signature data. Connected sources confirm the issue and link it to an OID-related parsing bug in libr/ut...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

PE Tree - Python Module For Viewing Portable Executable (PE) Files In A Tree-View

Python module for viewing Portable Executable PE files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro to dump in-memory PE files and reconstruct imports. Features Standalone application and IDAPython plugin Supports Windows/Linux/Mac Rainbow PE ratio map: High-level overview...

KLA11860 PE vulnerability in Microsoft System Center

An elevation of privilege vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2020-1461 Related products Microsoft-Forefront-Protection Windows-Defender CVE list CVE-2020-1461 warning KB list Solution Insta...

KLA11859 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Windows Diagnostics Hub...

Cisco Releases Security Updates for CML and VIRL-PE

Cisco has released security updates to address SaltStack FrameWork vulnerabilities in Cisco Modeling Labs Corporate Edition CML and Virtual Internet Routing Lab Personal Edition VIRL-PE. A remote attacker could exploit these vulnerabilities to take control of an affected system. The Cybersecurity...

MemoryMapper - Lightweight Library Which Allows The Ability To Map Both Native And Managed Assemblies Into Memory

Memory Mapper is a lightweight library which allows the ability to map both native and managed assemblies into memory by either using process injection of a process specified by the user or self-injection; the technique of injecting an assembly into the currently running process attempting to do...

Hackers Compromise Cisco Servers Via SaltStack Flaws

Cisco said attackers have been able to compromise its servers after exploiting two known, critical SaltStack vulnerabilities. The flaws exist in the open-source Salt management framework, which are used in Cisco network-tooling products. Two Cisco products incorporate a version of SaltStack that ...

KLA11782 PE vulnerability in Microsoft Browser

PE vulnerability was found in Microsoft Edge. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2020-1195 Related products Microsoft-Edge CVE list CVE-2020-1195 warning KB list Solution Install necessary updates from the Settings and more menu, that are...

KLA11772 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in .NET Framework can be...

KLA11747 Multiple vulnerabilities in Mycrosoft System Center

Multiple vulnerabilities were found in Mycrosoft System Center. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Microsoft Defender can be exploited remotely via specially crafted comma...

KLA11801 Security vulnerability in Zoom

Security vulnerability was found in Zoom. Malicious users can exploit this vulnerability to bypass security restrictions, gain privileges. Original advisories Zoom Security CVE-2020-11443 CVE-2020-11443 Related products Zoom-MSI CVE list CVE-2020-11443 critical Solution Update to the latest versi...

YARA webinar follow up

If you read my previous blogpost Hunting APTs with YARA then you probably know about the webinar we conducted on March 31, 2020, showcasing some of our experience in developing and using YARA rules for malware hunting. In case you missed the webinar - or if you attended and want to re-watch it -...

pe-becker.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1134256 Security Researcher metamorfosec Helped patch 1957 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting pe-becker.de website...

Q&A: Insights from the Red Canary 2020 Threat Detection Report

In light of the latest update to the MITRE ATT&CK framework, Red Canary has developed a Threat Detection Report uncovering the top techniques attackers use to target your organization. To understand the significance of the report, we turned to two of VMware Carbon Black’s top threat experts, Greg...

FreeBSD : puppetserver and puppetdb -- Puppet Server and PuppetDB may leak sensitive information via metrics API (36def7ba-6d2b-11ea-b115-643150d3111d)

Puppetlabs reports : Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types which may contain sensitive information as...

CVE-2020-7943

CVE-2020-7943 affects Puppet Server and PuppetDB, where the metrics API endpoints may disclose sensitive information. The issue stems from exposed metrics data (for PuppetDB: hostnames; for Puppet Server: resource names, titles, function names, and class names) when these endpoints were accessibl...