Aggregator

A vulnerability was found in TuneClone 2.20. It has been classified as critical. Affected by this issue is some unknown functionality of the component SEH Handler. This manipulation causes out-of-bounds write. This vulnerability is handled as CVE-2019-25603. It is possible to launch the attack on the local host. Additionally, an exploit exists.

A vulnerability was found in Nsauditor Backup Key Recovery 2.2.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Handler. The manipulation of the argument Name results in return of pointer value outside of expected range. This vulnerability is known as CVE-2019-25599. Attacking locally is a requirement. Furthermore, an exploit is available.

A vulnerability has been found in nsauditor DNSS Domain Name Search Software 2.1.8 and classified as critical. Affected is an unknown function of the component Registration Handler. The manipulation of the argument Name/Key leads to out-of-bounds write. This vulnerability is traded as CVE-2019-25591. An attack has to be approached locally. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, was found in Play EquityPandit 1.0. This impacts an unknown function of the component Forgot Password Handler. Executing a manipulation can lead to improper authorization of index containing sensitive information. This vulnerability appears as CVE-2019-25605. The physical device can be targeted for the attack. In addition, an exploit is available.

A vulnerability, which was classified as critical, has been found in Heidisql Portable 10.1.0.5464. This affects an unknown function. Performing a manipulation of the argument Password results in out-of-bounds write. This vulnerability is reported as CVE-2019-25598. The attack requires a local approach. Moreover, an exploit is present. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in Xlinesoft PHPRunner 10.1. The impacted element is an unknown function. Such manipulation of the argument dashboard name leads to improper handling of overlap between protected memory ranges. This vulnerability is documented as CVE-2019-25592. The attack needs to be performed locally. Additionally, an exploit exists.

A vulnerability classified as critical has been found in UltraVNC Viewer 1.2.2.4. The affected element is an unknown function. This manipulation of the argument VNC Server causes out-of-bounds write. This vulnerability is registered as CVE-2019-25600. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability described as critical has been identified in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Proxy Query Handler. The manipulation results in sql injection. This vulnerability is cataloged as CVE-2026-4597. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #775635 / VDB-352435

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CISA added the three […]

An information stealer called VoidStealer uses a new approach to bypass Chrome's Application-Bound Encryption (ABE) and extract the master key for decrypting sensitive data stored in the browser. [...]

通过pipe布局与off-by-null漏洞实现页级UAF，结合二级UAF构造任意地址读写，最终提权。

Это может быть ключ к комнатной сверхпроводимости.

Настраиваем родительский контроль правильно.

PSWA 是 Windows Server 2012 中引入的一个 Windows Server 功能，作为一个网关，提供基于网页的 PowerShell 控制台。它允许管理员从未运行Windows操作系统或未安装PowerShell的设备，在远程计算机上执行关键管理任务，但也有可能被滥用。

本文将大部分沙箱的内容做了小结，针对不同沙箱类型对绕过手法进行了分类，内容较多敬请谅解

某企业MES泄露源码审计

某堡垒机js逆向

用AI做代码安全审计：claude-code-security-skills 项目解析

re的进阶的知识，补充常见的理论以及新出现的wasm类型