Virus.Win32.Shodi.e Heap Corruption

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/37d4a5ba123dd32f1e2c4ba0be14e77cC.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Virus.Win32.Shodi.e Vulnerability: Heap Corruption Description: The virus listens on TCP port 7352...

PT-2021-15492

Name of the Vulnerable Software and Affected Versions Flask-User versions all Description The issue affects the make safe url function, allowing an attacker to bypass URL validation and redirect a user to an arbitrary URL by providing multiple backslashes, such as /////evil.com/path or...

flask-user 输入验证错误漏洞

Flask-User is a software application. Customizable user authentication and user management, register, confirm, login, change username, password, forget password, etc. A security vulnerability exists in Flask-User, which can be exploited to bypass url authentication and redirect a user to an...

Crackonosh virus mined $2 million of Monero from 222,000 hacked computers

A previously undocumented Windows malware has infected over 222,000 systems worldwide since at least June 2018, yielding its developer no less than 9,000 Moneros $2 million in illegal profits. Dubbed "Crackonosh," the malware is distributed via illegal, cracked copies of popular software, only to...

Prototype pollution in safe-flat

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

GHSA-33RV-M2GP-MM2R Prototype pollution in safe-flat

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

GHSA-WPGH-HMV4-R3V5 Prototype pollution in safe-obj

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

app.io (>=0.0.1, <=0.0.4), barbakoa (>=0.0.1, <=0.0.17) +21 more potentially affected by CVE-2021-25928 via safe-obj (1.0.2)

safe-obj NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on safe-obj and may be impacted: - app.io =0.0.1, =0.0.1, =0.4.0, =0.0.5, =0.0.1, =1.0.0, =1.0.0, =0.2.1, =1.0.0, =0.6.5, =0.3.0, =1.0.1, =1.0.0, =1.0.0, =1.2.2 and more Source cve...

Prototype pollution in safe-obj

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

Trojan.Win32.Alien.erf Denial Of Service

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/57ab194d8c60ee97914eda22e4d71b68.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Alien.erf Vulnerability: Remote Denial of Service Description: The malware deploys a SM...

GHSA-GCHQ-9R68-6JWV Cross-Site Request Forgery in Jenkins Credentials Plugin

Jenkins Credentials Plugin prior to 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting XSS vulnerability. Jenkins Credentials Plugin 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1,...

SUSE: Security Advisory (SUSE-SU-2014:0320-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron") 8.x (LTS "Carbon") and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

...

Google Chrome to Help Users Identify Untrusted Extensions Before Installation

Google on Thursday said it's rolling out new security features to Chrome browser aimed at detecting suspicious downloads and extensions via its Enhanced Safe Browsing feature, which it launched a year ago. To this end, the search giant said it will now offer additional protections when users...

My Notes Safe 5.3 Denial Of Service

Exploit Title: My Notes Safe 5.3 - Denial of Service PoC Date: 06-04-2021 Author: Geovanni Ruiz Download Link: https://apps.apple.com/us/app/my-notes-safe/id689971781 Version: 5.3 Category: DoS iOS Vulnerability Color Notes is vulnerable to a DoS condition when a long list of characters is being...

My Notes Safe 5.3 - Denial of Service (PoC)

Exploit Title: My Notes Safe 5.3 - Denial of Service PoC Date: 06-04-2021 Author: Geovanni Ruiz Download Link: https://apps.apple.com/us/app/my-notes-safe/id689971781 Version: 5.3 Category: DoS iOS Vulnerability Color Notes is vulnerable to a DoS condition when a long list of characters is being...

Violation of implicit constraints in batched operations may break protocol assumptions

Handle 0xRajeev Vulnerability details Impact The Ladle batching of operations is a complex task as noted by the project lead which has implicit constraints on what operations can be bundled together in a batch, which operations can/have-to appear how many times and in what order/sequence etc. Som...

Kids on the Web in 2021: Infinite creativity

For over a year weve been living in a world gripped by the COVID-19 pandemic. Not only has the pandemic affected peoples lifestyles, it has also accelerated the development and implementation of technologies that make it easier for us to complete everyday and work-related tasks. We no longer need...

Backdoor.Win32.Whirlpool.a Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/90171763d1cc62102b08482bac54ea8b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Whirlpool.a Vulnerability: Remote Buffer Overflow - UDP Datagram Description: The...

Unhandled return value of transferFrom in timeLockERC20() could lead to fund loss for recipients

Handle 0xRajeev Vulnerability details Impact ERC20 implementations are not always consistent. Some implementations of transfer and transferFrom could return ‘false’ on failure instead of reverting. It is safer to wrap such calls into require statements or use safe wrapper functions implementing...