CVE-2019-3787

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

Latest ECHOBOT: 26 Infection Vectors

Introduction Since the release of the Mirai source code in October of 2016, there have been hundreds of variants. While publishing my own research, I noticed that Palo Alto Networks was also examining similar samples, and published their findings. Earlier...

CVE-2019-1034

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors...

It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign

This blog was authored by Danny Adamitis, David Maynor and Kendall McKay. Executive summary Cisco Talos recently identified a series of documents that we believe are part of a coordinated series of cyber attacks that we are calling the "Frankenstein" campaign. We assess that the attackers carried...

Design/Logic Flaw

DISPUTED An issue was discovered in wcd9335codecenabledec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdupnul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a...

CVE-2019-5954

JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user's registered information via unspecified vectors...

CVE-2019-5931

Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors...

CVE-2019-5931

Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors...

Intel ZombieLoad Side-Channel Attack: 10 Takeaways

Intel on Tuesday revealed a new class of speculative execution vulnerabilities, dubbed Microarchitectural Data Sampling MDS, which impact all its modern CPUs. The flaws all ultimately depend on different ways of executing side channel attacks to siphon data from impacted systems – and result in...

kernel: memory leak when merging buffers in SCSI IO vectors

It was found that in the Linux kernel through v4.14-rc5, biomapuseriov and biounmapuser in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bioaddpcpage merges them into one, but the page reference is never dropped, causing a...

CVE-2019-5495

OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors...

Use-After-Free

mozilla firefox is vulnerable to use-after-free vulnerability. A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a denial of service condition via multiple vectors...

Denial Of Service (DoS)

mysql is vulnerable to denial of service DoS attacks. An unspecified vulnerability allows an local users to affect availability via vectors related to PS causing the application to crash...

Authorization Bypass

java is vulnerable to authorization bypass. An unspecified vulnerability allows a remote attacker to affect integrity via vectors related to Security...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS. It allows remote attackers to affect availability via unknown vectors...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS. It allows remote attackers to affect availability via unknown vectors...

Improper Access Control

MySQL is using improper access control. It allows remote authenticated users to affect availability via unknown vectors related to Partition...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS. It allows remote attackers to affect availability via unknown vectors...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. An unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI...