VulnCheck KEV: CVE-2023-21492

Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization ASLR bypass...

ByteDance-HIDS - A Cloud-Native Host-Based Intrusion Detection Solution Project To Provide Next-Generation Threat Detection And Behavior Audition With Modern Architecture

ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture. ByteDance-HIDS comprises three major components： ByteDance-HIDS Agent, co-worked with ByteDance-HIDS Driver , is the...

CVE-2021-0220

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...

CVE-2021-0220

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...

Design/Logic Flaw

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...

CVE-2021-0220 Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...

CVE-2021-0220

CVE-2021-0220 (Juniper Junos Space) affects Junos Space versions prior to 20.3R1. The issue is that shared secrets are stored in a recoverable format and can be exposed through the UI. An attacker who can run arbitrary code in the victim’s browser (e.g., via XSS) or access cached contents may obt...

Juniper Networks Junos OS Security Vulnerability

Juniper Networks Junos Space is a suite of network management solutions from Juniper Networks, Inc. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle. A security vulnerability exists in Junos Space versions prior to...

Stripo Inc: Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/

Summary: I have found a bypass for the report https://hackerone.com/reports/1047119 It seems that a proper fix was not issued therefore the issue still remains. Steps To Reproduce: 1. Create a Plug-In and capture the request. 1. Send this to Intruder 1. Follow the rest in the Video POC. POC Video...

LY Corporation: File sizes may be manipulated into negative numbers when uploading

The file sizes were manipulated into negative numbers when uploading. The message indicating insufficient storage space was displayed. However, the file size was recalculated and transmitted during the upload process, allowing the upload to proceed despite the negative file size...

The vulnerability of the kernel driver sncc0.sys of the Secret Net security system and Secret Net Studio, related to privilege management errors, allows attackers to bypass the Randomization of the Operating System’s Kernel Address Space (ASLR) mechanism.

The vulnerability of the kernel driver sncc0.sys in the Secret Net and Secret Net Studio security solutions is related to privilege management errors. Exploiting this vulnerability allows an attacker to bypass the Randomization of the Operating System’s Kernel Address Space ASLR mechanism and...

Telerik Fiddler Code Injection Vulnerability

Telerik Fiddler is an HTTP protocol debugging proxy tool. A code injection vulnerability exists in Telerik Fiddler 5.0.20202.18177 and earlier versions, which allows an attacker to execute an arbitrary program via a hostname with a space character at the end, followed by the --utility-and-browser...

Command Execution Vulnerability in Deep Space Programming Live Client

Deep Space Programming Live Client is a live streaming software from Programming Cat. Deep Space Programming Live Client has a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...

Patrick Wardle on Hackers Leveraging 'Powerful' iOS Bugs in High-Level Attacks

A recently uncovered zer0-click Apple zero-day flaw, used in a spyware campaign against Al Jazeera journalists, shed light this week on the impact of Apple security issues being abused by bad actors. In 2020, the security research community saw an array of “powerful” Apple bugs afflicting iOS,...

A week in security (December 14 – December 20)

Last week on Malwarebytes Labs we kept you updated on the SolarWinds attack, we warned about the special dangers that come with the Christmas season, published a threat profile for the Egregor ransomware, warned how a lead generation scam was targeting potential Malwarebytes MSP partners, and...

Race condition

Compiler Optimization Removal or Modification of Security-critical Code vulnerability in IntPeParseUnwindData results in multiple dereferences to the same pointer. If the pointer is located in memory-mapped from the guest space, this may cause a race-condition where the generated code would...

CVE-2020-27777

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down usually due to Secure Boot guest system running on top of PowerVM or KVM hypervisors pseries platform a root like local user could use this flaw to further increase their privileges to...

virt:rhel bug fix update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

ALBA-2020:5494 virt:rhel bug fix update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2020:3164-1)

This update for ImageMagick fixes the following issues : CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c bsc1178067. Fixed greyish image produced by incorrect colorspace bsc1106272. Note that Tenable Network Security has extracted the...