PT-2021-21193

Name of the Vulnerable Software and Affected Versions Dell DBUtilDrv2.sys driver versions 2.5 and 2.6 Description The issue is related to an insufficient access control vulnerability in the Dell DBUtilDrv2.sys driver, which may lead to escalation of privileges, denial of service, or information...

CVE-2020-36434

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sysinfo::diskinfo calls can trigger a double free...

Double free

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sysinfo::diskinfo calls can trigger a double free...

CVE-2020-36434

The CVE-2020-36434 issue affects the Rust crate sys-info prior to version 0.8.0. The root cause is a static/global list used to store temporary disk information; cleanup code (DFCleanup) assumes a single-threaded environment and can free the same memory twice when sys_info::disk_info is invoked c...

CVE-2020-36434

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sysinfo::diskinfo calls can trigger a double free...

An admin can downgrade or remove a group with sys admin privilege

This vulnerability affects certain versions of Atlassian Dev Tools. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent...

An admin can downgrade or remove a group with sys admin privilege

This vulnerability affects certain versions of Atlassian Dev Tools. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent...

blktrace: Buffer overflow

Background blktrace shows detailed information about what is happening on a block device IO queue. Description A crafted file could cause a buffer overflow in the ‘devmapread’ function because the device and devno arrays are too small. Impact A remote attacker could entice a user to open a...

Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data Theft

Flaws impacting millions of internet of things IoT devices running NVIDIA’s Jetson chips open the door for a variety of hacks, including denial-of-service DoS attacks or the siphoning of data. NVIDIA released patches addressing nine high-severity vulnerabilities including eight additional bugs of...

Fedora: Security Advisory for rust-aom-sys (FEDORA-2021-1c3f7963a5)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: rust-aom-sys-0.2.1-5.fc34

FFI bindings to aom...

Fortinet FortiProxy SSL VPN 缓冲区错误漏洞

Fortinet FortiProxy SSL VPN is a software application from Fortinet. It provides an intrusion detection feature. A buffer error vulnerability exists in Fortinet FortiProxy SSL VPN, which stems from a boundary error in the FortiProxy physical device CLI. An authenticated remote user can run...

virt:ol and virt-devel:rhel security, bug fix, and enhancement update

libvirt 6.0.0-35.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 - Add runtime deps for pkg librbd1 = 1:10.2.5 Keshav Sharma - Disable parallel builds Karl Heubaum libvirt-dbus 1.3.0 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release libvirt-python...

Metasploit Wrap-Up

Dell DBUtil23.sys IOCTL memmove privilege escalation Our very own zeroSteiner added a new module, which exploits insufficient access control in Dell's dbutil23.sys firmware update driver included in the Dell Bios Utility that comes pre-installed with most Windows machines. The driver accepts...

Exploit for Use After Free in Microsoft

CVE-2021-31166 is a proof of concept for a remote UAF Use-After-Free vulnerability in the HTTP.sys protocol stack. The bug occurs in the http!UlpParseContentCoding function, which appends items to a local LISTENTRY and then moves it into the Request structure without NULLing out the local list...

DELL dbutil_2_3.sys 2.3 Arbitrary Write / Privilege Escalation

Exploit Title: DELL dbutil23.sys 2.3 - Arbitrary Write to Local Privilege Escalation LPE Date: 10/05/2021 Exploit Author: Paolo Stagno aka VoidSec Version: include include include include define IOCTLCODE 0x9B0C1EC8 // IOCTLCODE value, used to reach the vulnerable function taken from IDA define...

virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

An update is available for libguestfs, libnbd, nbdkit, libguestfs-winsupport, supermin, libiscsi, hivex, libvirt, netcf, perl-Sys-Virt, seabios, qemu-kvm, sgabios, libvirt-dbus, libvirt-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2021-31728

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...

Dell DBUtil_2_3.sys IOCTL Memory Read / Write Exploit

The DBUtil23.sys driver distributed by Dell exposes an unprotected IOCTL interface that can be abused by an attacker to read and write kernel-mode memory. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MalwareFox Anti-Malware 安全漏洞

MalwareFox Anti-Malware is an application from the American company MalwareFox. A malicious code detection software. MalwareFox AntiMalware 2.74.0.150 suffers from a security vulnerability that stems from incorrect access control in zam64.sys, zam32.sys...