CVE-2018-1000856: Improper Neutralization of Input During Web Page Generation

DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting XSS vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear t...

PT-2018-9580

Name of the Vulnerable Software and Affected Versions DomainMOD versions 4.09.03 through 4.11.01 Description The issue concerns a Cross Site Scripting XSS vulnerability in the Segment Name field on the segments page. This can lead to the execution of arbitrary scripts on the browsers of all users...

The vulnerability of the libdwfl library in the ELF Elfutils utility for modifying and analyzing binary files allows a attacker to cause a service failure.

The vulnerability of the libdwfl library’s dwflsegmentreportmodule.c file, a tool for modifying and analyzing binary ELF files, is due to a buffer overflow segmentation fault. Exploiting this vulnerability could allow an attacker to cause a service failure by using a specially created ELF file...

CVE-2018-18358

Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file...

CVE-2018-18358

Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file...

UPDATE: Infection Monkey 1.6.1

PenTestIT RSS Feed I'm sure you must have read my previous post title the List of Adversary Emulation Tools. In that post, I briefly mentioned about the Guardicore Infection Monkey. Good news now is that it has been updated! We now have Infection Monkey 1.6.1. An important change about this versi...

FreeRDP Buffer Overflow Vulnerability (CNVD-2019-00654)

FreeRDP is a free, open source implementation of the Remote Desktop Protocol RDP developed by the FreeRDP team. A heap buffer overflow vulnerability in the 'zgfxdecompresssegment' function in versions prior to FreeRDP 2.0.0-rc4 can be exploited by a remote attacker to cause a denial of service...

Memory Overwrite

github.com/google/gvisor is vulnerable to memory overwrite attacks. The vulnerability through repeated calls of shmctlIPCRMID which forces a segment to be destroyed prematurely. This could be reused and accessible by a different process...

Design/Logic Flaw

BlueStacks App Player BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later allows an attacker on the same network segment to bypass access restriction to gain unauthorized access...

CVE-2018-0701: Undefined Security Weakness

BlueStacks App Player BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later allows an attacker on the same network segment to bypass access restriction to gain unauthorized access...

PT-2018-9025

Name of the Vulnerable Software and Affected Versions BlueStacks App Player versions 3.0.0 through 4.31.55 BlueStacks App Player for macOS version 2.0.0 and later Description The issue allows an attacker on the same network segment to bypass access restrictions and gain unauthorized access...

kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack)

A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcpcollapseofoqueue and tcppruneofoqueue functions by sending specially modified packets within ongoing T...

DEBIAN-CVE-2018-18310

An invalid memory address dereference was discovered in dwflsegmentreportmodule.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service application crash with a crafted ELF file, as demonstrated by considernotes...

CVE-2018-18310

An invalid memory address dereference was discovered in dwflsegmentreportmodule.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service application crash with a crafted ELF file, as demonstrated by considernotes...

UBUNTU-CVE-2018-18310

An invalid memory address dereference was discovered in dwflsegmentreportmodule.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service application crash with a crafted ELF file, as demonstrated by considernotes...

PT-2018-1913

Name of the Vulnerable Software and Affected Versions elfutils versions through 0.174 Description The issue is caused by an invalid memory address dereference in the dwfl segment report module.c file of the libdwfl library in elfutils. This can lead to a denial of service, where an attacker can...

Google PDFium JBIG2 image ComposeToOpt2WithRect information disclosure vulnerability

Summary An exploitable out-of-bounds read on the heap vulnerability exists in the JBIG2 parsing code of Google Chrome version 67.0.3396.99. A specially crafted PDF document can trigger an out-of-bounds read, which can possibly lead to an information leak that could be used as part of an exploit. ...

CVE-2018-0662

Multiple I-O DATA network camera products TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code...

Artifex MuPDF Denial of Service Vulnerability (CNVD-2020-54496)

Artifex MuPDF is a free, lightweight PDF reader from Artifex Software. A security vulnerability exists in the 'fzappendbyte' function in the fitz/buffer.c file in Artifex MuPDF version 1.13.0. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error with th...

Unspecified Vulnerability in Artifex MuPDF

Artifex MuPDF is a free, lightweight PDF reader from Artifex Software. A security vulnerability exists in the 'pdfgetxrefentry' function in the pdf/pdf-xref.c file in Artifex MuPDF version 1.13.0. A remote attacker can exploit this vulnerability with the help of a specially crafted pdf file to...