article thumbnail

Seeing Like a Data Structure

Schneier on Security

We are about to find out, as we begin to see the world through the lens of data structures. This is what life is like when we see the world the way a data structure sees the world. Nearly every university’s curriculum immediately introduces these students to data structures.

article thumbnail

CISA adds NextGen Healthcare Mirth Connect flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

Deserialization of untrusted data vulnerability is a security flaw that occurs when an application deserializes data from an untrusted source without properly validating or sanitizing it. The flaw impacts NextGen Healthcare Mirth Connect before version 4.4.1,

IT 323
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Cisco Talos discovered 2 critical flaws in the popular OpenCV library

Security Affairs

The CVE-2019-5063 is a heap buffer overflow vulnerability that exists in the data structure persistence functionality of OpenCV 4.1.0. ” The CVE-2019-5064 vulnerability resides in the data structure persistence functionality of the same library and can be triggered by attackers using a specially crafted JSON file.

Libraries 243
article thumbnail

ZLoader Malware adds Zeus’s anti-analysis feature

Security Affairs

.” Zscaler observed that Zloader’s method of storing installation data to evade detection shows similarities to Zeus version 2.0.8, Instead of using the Registry, Zloader uses a data structure called PeSettings to store its configuration. albeit with a different implementation.

article thumbnail

CISA adds Microsoft COM for Windows bug to its Known Exploited Vulnerabilities catalog

Security Affairs

A deserialization of untrusted data vulnerability arises when an application deserializes data from an untrusted source without proper validation. Deserialization is the process of converting data from a serialized format (like JSON or XML) back into an object or data structure in memory.

IT 323
article thumbnail

Critical flaws in myPRO HMI/SCADA product could allow takeover vulnerable systems

Security Affairs

The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. . “The specific flaw exists within the parsing of HMI files. User interaction is required to exploit the vulnerability in that a user must open a malicious HMI file.”

article thumbnail

Microsoft releases out-of-band update to fix Kerberos auth issues caused by a patch for CVE-2022-37966

Security Affairs

. “An unauthenticated attacker could conduct an attack that could leverage cryptographic protocol vulnerabilities in RFC 4757 (Kerberos encryption type RC4-HMAC-MD5) and MS-PAC (Privilege Attribute Certificate Data Structure specification) to bypass security features in a Windows AD environment.”