PT-2021-1540

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 87.0.4280.141 Description The issue is related to a use-after-free vulnerability in safe browsing. This allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...

PT-2021-1534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 87.0.4280.141 Description The issue is related to a use after free in safe browsing, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could impact the...

Backdoor.Win32.Zombam.k Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: https://malvuln.com/advisory/79d9908b6769e64f922e74a090f5ceeb.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.k Vulnerability: Remote String Dereference Stack Buffer Overflow Description:...

CVE-2020-26292

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source...

Backdoor.Win32.Zombam.j Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: http://malvuln.com/advisory/a4212f23e1cc3bb34b0dfe15b2ad323e.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.j Vulnerability: Remote Stack Buffer Overflow Description: Listens on TCP port...

SQL Injection Vulnerability in DSS Safe City System of Zhejiang Dahua Technology Co.(CNVD-2021-01865)

Zhejiang Dahua Technology Co., Ltd. is a supplier of surveillance products and solution service provider. DSS Safe City System of Zhejiang Dahua Technology Co., Ltd. suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Rust Competition Condition Problem Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust futures-util crate before 0.3.7, which stems from the fact that MutexGuard::map can lead to data contention in certain closure cases in safe code...

SQL Injection Vulnerability in DSS Safe City System of Zhejiang Dahua Technology Co.(CNVD-2021-01866)

Zhejiang Dahua Technology Co., Ltd. is a supplier of surveillance products and solution service provider. DSS Safe City System of Zhejiang Dahua Technology Co., Ltd. suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Brave Software: Phishing/Malware site blocking on Brave iOS can be bypassed with trailing dot in hostname

A vulnerability was discovered in Brave iOS nightly build that allowed bypassing of the phishing/malware site blocking feature by adding a trailing dot in the hostname. This allowed users to access prohibited sites without being blocked by Brave Shield protection...

SQL Injection Vulnerability in DSS Safe City System of Zhejiang Dahua Technology Co.(CNVD-2020-75024)

Zhejiang Dahua Technology Co., Ltd, is the world's leading video-centered intelligent IOT solution provider and operation service provider, providing end-to-end video surveillance solutions, systems and services for city operations and more. A SQL injection vulnerability exists in the DSS Safe Ci...

SQL Injection Vulnerability in DSS Safe City System of Zhejiang Dahua Technology Co.(CNVD-2020-75025)

Zhejiang Dahua Technology Co., Ltd, is the world's leading video-centered intelligent IOT solution provider and operation service provider, providing end-to-end video surveillance solutions, systems and services for city operations and more. A SQL injection vulnerability exists in the DSS Safe Ci...

Cybercriminals' Favorite Bulletproof VPN Service Shuts Down In Global Action

Law enforcement agencies from the US, Germany, Netherlands, Switzerland, France, along with Europol's European Cybercrime Centre EC3, announced today the coordinated takedown of Safe-Inet, a popular virtual private network VPN service that was used to facilitate criminal activity. The three domai...

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

UBUNTU-CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

Dell BSAFE Micro Edition Suite 缓冲区错误漏洞

The Dell BSAFE Micro Edition Suite is a Dell development toolkit that provides encryption, certificate and transport layer security for c/c++ applications, devices and systems. A buffer overflow vulnerability exists in Dell BSAFE Micro Edition Suite version 4.5, which stems from vulnerability to...

ALPINE-CVE-2020-29485

An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XSRESETWATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are...

DEBIAN-CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

UBUNTU-CVE-2020-29485

An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XSRESETWATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are...

PT-2020-6136 · Thornton Rose +3 · Xstream +3

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.15 Description: The issue is related to a Server-Side Forgery Request vulnerability in XStream, a Java library used to serialize objects to XML and back again. This vulnerability can be activated when unmarshalli...

RUSTSEC-2020-0097 Soundness issue with base::Error

base::Error type contains public field named ptr. With this definition, it is possible to create a base::Error with an invalid pointer and trigger memory safety errors such as use-after-free or double-free with safe Rust. The users of xcb crate are advised not to manipulate the field...