CVE-2021-3041 Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation

A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory...

Aruba ClearPass Policy Manager elevation of privilege vulnerability (CNVD-2021-13472)

Aruba ClearPass Policy Manager is a network access control NAC solution. An elevation of privilege vulnerability exists in ClearPass OnGuard prior to Aruba ClearPass Policy Manager versions 6.9.5, 6.8.8-HF1, and 6.7.14-HF1, which can be exploited by a locally authenticated user on Windows platfor...

Palo Alto Networks Cortex XDR Agent Code Issue Vulnerability

Palo Alto Networks Cortex XDR Agent is a client software for checking the security of client devices from Palo Alto Networks Malaysia. A security vulnerability exists in Palo Alto Networks Cortex XDR that originates from a local privilege escalation vulnerability in the agent on Windows platforms...

webkitgtk: Logic issue may lead to cross site scripting

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross...

CVE-2020-9919

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead t...

CVE-2020-9873

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to...

Mozilla Thunderbird, Firefox ESR and Firefox Injection Vulnerabilities

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software separate from the Mozilla Application...

Mozilla Firefox and Firefox ESR Input Validation Error Vulnerability (CNVD-2020-54930)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox ESR versions prior to 68.8 an...

Foxit Reader and PhantomPDF communication API Arbitrary File Write Vulnerability

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in the communication API in Foxit Reader and Foxit PhantomPDF 9.7.1.29511 and earlier versions for Windows platforms. The vulnerability can be exploited to execute arbitra...

Foxit Reader and PhantomPDF Resource Management Error Vulnerability (CNVD-2020-24465)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A resource management error vulnerability exists in AcroForms handling in Foxit Reader and Foxit PhantomPDF 9.7.1.29511 and earlier versions for Windows platforms, where the program fails to validate the...

Metamorfo Returns with Keylogger Trick to Target Financial Firms

Researchers have discovered a recent spate of phishing emails spreading a new variant of Metamorfo, a financial malware known for targeting Brazilian companies. Now, however, it’s expanding its geographic range and adding a new technique. Metamorfo was first discovered in April 2018, in various...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Identity Insight on Windows platforms (CVE-2019-4732)

Summary There is a vulnerability in the IBM Java SDK that is used by IBM WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. This vulnerability affects Windows platforms only. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes secti...

Mozilla Firefox and Mozilla Firefox ESR Buffer Overflow Vulnerability (CNVD-2020-01177)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A buffer overflow vulnerability exists in Mozilla Firefox versions prior to 72 a...

DEBIAN-CVE-2019-8622

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code...

ThinVNC 1.0b1 - Authentication Bypass Exploit

Exploit Title: ThinVNC 1.0b1 - Authentication Bypass Exploit Author: Nikhith Tumamlapalli Contributor WarMarX Vendor Homepage: https://sourceforge.net/projects/thinvnc/ Software Link: https://sourceforge.net/projects/thinvnc/files/ThinVNC1.0b1/ThinVNC1.0b1.zip/download Version: 1.0b1 Tested on:...

ALPINE-CVE-2019-15162

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames...

webkitgtk: logic issue leads to code execution

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website...

Microsoft Edge Chakra Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2019-24843)

Microsoft Edge is Microsoft's new browser, migrating from the EdgeHTML kernel to the Chromium kernel, and will also be coming to Windows 7/8/8.1 and macOS platforms. A remote memory corruption vulnerability exists in Microsoft Edge Chakra Scripting Engine, which can be exploited by an attacker to...

Microsoft DirectX Information Disclosure Vulnerability (CNVD-2019-10430)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. DirectX is one of the multimedia system libraries. An information disclosure vulnerability...

DEBIAN-CVE-2018-4328

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...