‼ CVE-2020-27247 ‼
📖 Read
via "National Vulnerability Database".
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13579 ‼
📖 Read
via "National Vulnerability Database".
An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser perform arithmetic that may overflow which can result in an undersized heap allocation. Later when copying data from the file into this allocation, a heap-based buffer overflow will occur which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27248 ‼
📖 Read
via "National Vulnerability Database".
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14245 ‼
📖 Read
via "National Vulnerability Database".
HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14246 ‼
📖 Read
via "National Vulnerability Database".
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26687 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. In preloaded applications, the HostnameVerified default is mishandled. The LG ID is LVE-SMP-200029 (February 2021).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13586 ‼
📖 Read
via "National Vulnerability Database".
A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13580 ‼
📖 Read
via "National Vulnerability Database".
An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26688 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 (February 2021).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6088 ‼
📖 Read
via "National Vulnerability Database".
An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27249 ‼
📖 Read
via "National Vulnerability Database".
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14247 ‼
📖 Read
via "National Vulnerability Database".
HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID.📖 Read
via "National Vulnerability Database".
❌ Clearview Facial-Recognition Technology Ruled Illegal in Canada ❌
📖 Read
via "Threat Post".
The company’s controversial practice of collecting and selling billions of faceprints was dealt a heavy blow by the Privacy Commissioner that could set a precedent in other legal challenges.📖 Read
via "Threat Post".
Threat Post
Clearview Facial-Recognition Technology Ruled Illegal in Canada
The company’s controversial practice of collecting and selling billions of faceprints was dealt a heavy blow by the Privacy Commissioner that could set a precedent in other legal challenges.
🦿 Industrial control systems vulnerabilities rise as operational tech increasingly goes online 🦿
📖 Read
via "Tech Republic".
Claroty said 25% more vulnerabilities were reported in 2020 than in 2019, 70% of which had high or critical CVSS scores.📖 Read
via "Tech Republic".
TechRepublic
Industrial control systems vulnerabilities rise as operational tech increasingly goes online
Claroty said 25% more vulnerabilities were reported in 2020 than in 2019, 70% of which had high or critical CVSS scores.
🛠 Clam AntiVirus Toolkit 0.103.1 🛠
📖 Read
via "Packet Storm Security".
Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command-line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use in your own software.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Clam AntiVirus Toolkit 0.103.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 TOR Virtual Network Tunneling Tool 0.4.4.7 🛠
📖 Read
via "Packet Storm Security".
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).📖 Read
via "Packet Storm Security".
Packetstormsecurity
TOR Virtual Network Tunneling Tool 0.4.4.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🦿 Why schools are vulnerable to ransomware attacks 🦿
📖 Read
via "Tech Republic".
A lack of security training for educators and budget limitations are two reasons schools are susceptible to cyberattack, says IBM Security.📖 Read
via "Tech Republic".
TechRepublic
Why schools are vulnerable to ransomware attacks
A lack of security training for educators and budget limitations are two reasons schools are susceptible to cyberattack, says IBM Security.
⚠ Free coffee! Dutch researcher hacks prepaid vending machines ⚠
📖 Read
via "Naked Security".
Only try this at home, folks! As easy as it might look, it's illegal in the wild, with good reason.📖 Read
via "Naked Security".
Naked Security
Free coffee! Belgian researcher hacks prepaid vending machines
Only try this at home, folks! As easy as it might look, it’s illegal in the wild, with good reason.
🕴 Is $50,000 for a Vulnerability Too Much? 🕴
📖 Read
via "Dark Reading".
Lofty bug bounties catch attention, but don't alleviate the application security flaws they are trying to solve.📖 Read
via "Dark Reading".
Dark Reading
Is $50,000 for a Vulnerability Too Much?
Lofty bug bounties catch attention, but don't alleviate the application security flaws they are trying to solve.
❌ Critical Cisco Flaws Open VPN Routers Up to RCE Attacks ❌
📖 Read
via "Threat Post".
The vulnerabilities exist in Cisco's RV160, RV160W, RV260, RV260P, and RV260W VPN routers for small businesses.📖 Read
via "Threat Post".
Threat Post
Critical Cisco Flaws Open VPN Routers Up to RCE Attacks
The vulnerabilities exist in Cisco's RV160, RV160W, RV260, RV260P, and RV260W VPN routers for small businesses.
❌ Microsoft Office 365 Attacks Sparked from Google Firebase ❌
📖 Read
via "Threat Post".
A savvy phishing campaign manages to evade native Microsoft security defenses, looking to steal O365 credentials.📖 Read
via "Threat Post".
Threat Post
Microsoft Office 365 Attacks Sparked from Google Firebase
A savvy phishing campaign manages to evade native Microsoft security defenses, looking to steal O365 credentials.