Orcus RAT Author Charged in Malware Scheme

In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with...

Description of the security update for SharePoint Server 2019 Language Pack: November 12, 2019

None None...

DLL Search Path and Symbolic Link Vulnerabilities - Lenovo Support US

No description provided...

Study: Ransomware, Data Breaches at Hospitals tied to Uptick in Fatal Heart Attacks

Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a large...

CVE-2019-18644

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted...

Code injection

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted...

Design/Logic Flaw

The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories...

CVE-2019-18644

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted...

CVE-2019-18644

The CVE-2019-18644 entry describes a TOCTOU vulnerability in the malware scan function of Total Defense Anti-virus 11.5.2.28. The issue allows symbolic link attacks to delete privileged files, i.e., an attacker could exploit the TOCTOU race condition to gain or cause modification/deletion of prot...

CVE-2019-18645

The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories...

CVE-2019-18645

CVE-2019-18645 affects Total Defense Anti-virus 11.5.2.28. The quarantine restoration function is susceptible to symbolic link attacks, allowing files to be written to privileged directories. The cited sources consistently describe a local impact enabling modification of privileged targets via th...

MailScanner Input Validation Error Vulnerability

MailScanner is an open source email filter for the Linux platform. The product is capable of scanning email for viruses, spam, phishing and malware. An input validation error vulnerability exists in MailScanner, which can be exploited by a local attacker to prevent the update of virus signatures...

CVE-2010-3293

mailscanner can allow local users to prevent virus signatures from being updated...

CVE-2010-3293

mailscanner can allow local users to prevent virus signatures from being updated...

Code injection

mailscanner can allow local users to prevent virus signatures from being updated...

CVE-2010-3293

mailscanner can allow local users to prevent virus signatures from being updated...

CVE-2010-3293

CVE-2010-3293 affects MailScanner. Multiple connected documents describe a local vulnerability that allows a local attacker to prevent virus signature updates, impacting integrity of antivirus definitions. Concrete root cause details (code path, component, affected versions) are not provided in t...

Talos takes home top research honors at Virus Bulletin conference

By Jon Munshaw Researchers from Cisco Talos brought up the top award at this year’s Virus Bulletin conference. Talos received the Péter Ször Award — named for the prolific security researcher who was a longtime contributor to Virus Bulletin and passed away in 2013 — for our research into several...

Yokogawa Products

1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Low skill level to exploit Vendor: Yokogawa Equipment: Exaopc, Exaplog, Exaquantum, Exasmoc, Exarqe, GA10, and InsightSuiteAE Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a...

Windows‌ ‌Exploitation‌ ‌Tricks:‌ ‌Spoofing‌ ‌Named‌ ‌Pipe‌ ‌Client‌ ‌PID‌

Posted by James Forshaw, Project Zero While researching the Access Mode Mismatch in IO Manager bug class I came across an interesting feature in named pipes which allows a server to query the connected clients PID. This feature was introduced in Vista and is exposed to servers through the...