SoK: Taxonomizing the Low-Level Attack Surface of Modern Web Browsers

The web browser remains one of the most exposed remote attack surfaces on end-user systems, and memory-corruption flaws continue to play a central role in real-world browser exploitation. Despite a decade of intensive browser testing and bug-disclosure efforts, the community still lacks an...

Cisco Firepower Threat Defense DoS

The vulnerability of Cisco Firepower Threat Defense’s microprogramming software exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to trigger a Denial-of-Service Attack DoS...

Schneider Electric PLC

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium lies in insufficient testing for unusual or exceptional states. Exploiting this vulnerability can allow an attacker operati...

Schneider Electric Modicon M340 Insufficient State Checking

The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controller is related to insufficient testing of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to cause malfunctions during maintenance operations...

Microsoft .NET Framework Code Execution

The vulnerability of the Microsoft .NET Framework software exists due to insufficient testing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file from a remote location...

Intel Active Management Technology Buffer Overflow

The vulnerability of Intel Active Management Technology’s microprogramming software exists due to insufficient testing of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...