CVE-2020-24753

A memory corruption vulnerability in Objective Open CBOR Run-time oocborrt in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation CBOR input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings...

CVE-2020-24753

A memory corruption vulnerability in Objective Open CBOR Run-time oocborrt in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation CBOR input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings...

CVE-2020-24753

A memory corruption vulnerability in Objective Open CBOR Run-time oocborrt in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation CBOR input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings...

CVE-2020-1575

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Spyre - Simple YARA-based IOC Scanner

...a simple, self-contained modular host-based IOC scanner Spyre is a simple host-based IOC scanner built around the YARA pattern matching engine and other scan modules. The main goal of this project is easy operationalization of YARA rules and other indicators of compromise. Users need to bring...

CVE-2020-6361

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE files received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...

Siemens License Management Utility (LMU) Elevation of Privilege Vulnerability

License Management Utility LMU is a unified license management system for Siemens Building Automation products such as Desigo CC and ABT. An elevation of privilege vulnerability exists in Siemens License Management Utility LMU. This allows a locally authenticated attacker to execute arbitrary...

VulnCheck KEV: CVE-2020-25213

WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Sep 2020)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

http-run (=0.0.1) potentially affected by unknown CVE via requet (=0.0.1-security)

requet NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on requet and may be impacted: - http-run =0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-H44F-769Q-J6PX...

GHSA-P33Q-W45H-2HCJ Malicious Package in 4equest

All versions of 4equest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process w...

PT-2020-15464 · Jenkins · Jenkins Cadence Vmanager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cadence vManager Plugin versions 3.0.4 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because build descriptions in tooltips are not properly escaped, allowing attackers...

The vulnerability of the Click-to-Run components of Microsoft Office and Office 365, related to memory object processing errors, allows attackers to escalate their privileges.

The vulnerability of the Click-to-Run components of Microsoft Office and Office 365 is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges using a specially crafted file...

ASX To MP3 Converter 3.1.3.7.2010.11.05 Buffer Overflow

Exploit Title: ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow DEP,ASLR Bypass PoC Software Link Download: https://github.com/x00x00x00x00/ASXtoMP3Converter3.1.3.7.2010.11.05/blob/master/ASXtoMP3Converter3.1.3.7.2010.11.05.exe?raw=true Exploit Author: Paras Bhatia Discovery...

OSV-2020-1661 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25181 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

CVE-2020-1581

An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run C2R components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the syste...

CVE-2020-1581

An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run C2R components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the syste...

CVE-2020-1556

An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a...

CVE-2020-1581 Microsoft Office Click-to-Run Elevation of Privilege Vulnerability

...

CVE-2020-1581

CVE-2020-1581 is an elevation of privilege vulnerability in Microsoft Office Click-to-Run (C2R). The issue stems from how C2R components handle objects in memory, enabling an attacker who already has code execution rights to elevate privileges by running a specially crafted application. The offic...