671 matches found
Description of the security update for Excel 2010: October 13, 2020
Description of the security update for Excel 2010: October 13, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following securi...
Description of the security update for Outlook 2013: October 13, 2020
Description of the security update for Outlook 2013: October 13, 2020 Summary This security update resolves a denial of service vulnerability that exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory. To learn more about the vulnerability, see...
Servicing stack update for Windows 10, version 1803: October 13, 2020
None None...
Description of the security update for Office 2016: September 8, 2020
None None...
Description of the security update for Office 2013: September 8, 2020
Description of the security update for Office 2013: September 8, 2020 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Excel if the software does not correctly handle objects in memory. To learn more about the vulnerability, see Microsoft Common...
Description of the security update for Excel 2010: September 8, 2020
Description of the security update for Excel 2010: September 8, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following...
Insufficient Entropy in parsel
All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching. Recommendation The package is deprecated an...
Description of the security update for Office 2010: August 11, 2020
Description of the security update for Office 2010: August 11, 2020 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Access software if the software does not correctly handle objects in memory. To learn more about the vulnerability, see Microsof...
Raining SYSTEM Shells with Citrix Workspace app
TL;DR Citrix Workspace is vulnerable to a remote command execution attack running under the context of the SYSTEM account. By sending a crafted message over a named pipe and spoofing the client process ID, the Citrix Workspace Updater Service can be tricked into executing an arbitrary process und...
Servicing stack update for Windows 10: July 14, 2020
None None...
Description of the security update for Word 2013: July 14, 2020
Description of the security update for Word 2013: July 14, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following Microsoft...
Servicing stack update for Windows 10, version 1809: July 14, 2020
None None...
Cellebrite EPR Decryption Hardcoded AES Key Material Vulnerability
The Cellebrite UFED Physical device relies on key material hardcoded within both the executable code supporting the decryption process and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of...
Cellebrite EPR Decryption Relies on Hardcoded AES Key Material
Vulnerability Details Affected Vendor: Cellebrite Affected Product: UFED Affected Version: 5.0 - 7.5.0.845 Platform: Embedded Windows CWE Classification: CWE-321: Hardcoded Use of Cryptography Keys CVE ID: CVE-2020-14474 2. Vulnerability Description The Cellebrite UFED Physical device relies on...
CVE-2020-10275 RVD#2565: Weak token generation for the REST API.
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64USERNAME:sha256PASSWORD. An unauthorized attacker inside the network can use the defaul...
CVE-2020-10274
MiR robots are affected by CVE-2020-10274 in combination with CVE-2020-10273. Affected products include MiR100, MiR200, MiR250, MiR500, MiR1000 and MiR Fleet, with MiR Robot Software versions prior to 2.10.2.1 (per ICS advisory) and older firmware versions (MiR controllers prior to 2.8.1.1) per N...
Description of the security update for SharePoint Foundation 2013: June 9, 2020
Description of the security update for SharePoint Foundation 2013: June 9, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the...
Description of the security update for Office 2016: June 9, 2020
None None...
Servicing stack update for Windows 10, version 1709: June 9, 2020
None None...
MemoryMapper - Lightweight Library Which Allows The Ability To Map Both Native And Managed Assemblies Into Memory
Memory Mapper is a lightweight library which allows the ability to map both native and managed assemblies into memory by either using process injection of a process specified by the user or self-injection; the technique of injecting an assembly into the currently running process attempting to do...