🦿 4 phishing scams to watch out for during the holidays 🦿
📖 Read
via "Tech Republic".
Fake shipping notices and charity frauds are two scams cited by the security company GreatHorn, which offers tips to consumers on how to avoid them.📖 Read
via "Tech Republic".
TechRepublic
4 phishing scams to watch out for during the holidays
Fake shipping notices and charity frauds are two scams cited by the security company GreatHorn, which offers tips to consumers on how to avoid them.
🔏 Friday Five 11/13 🔏
📖 Read
via "Digital Guardian".
Cyber Command trolling, end-to-end encryption debates, and stolen source code - catch up on all the week's infosec news with the Friday Five!📖 Read
via "Digital Guardian".
Digital Guardian
Friday Five 11/13
Cyber Command trolling, end-to-end encryption debates, and stolen source code - catch up on all the week's infosec news with the Friday Five!
‼ CVE-2020-6148 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS section decompression heap overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8583 ‼
📖 Read
via "National Vulnerability Database".
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25538 ‼
📖 Read
via "National Vulnerability Database".
An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25165 ‼
📖 Read
via "National Vulnerability Database".
BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a network session authentication vulnerability within the authentication process between specified versions of the BD Alaris PC Unit and the BD Alaris Systems Manager. If exploited, an attacker could perform a denial-of-service attack on the BD Alaris PC Unit by modifying the configuration headers of data in transit. A denial-of-service attack could lead to a drop in the wireless capability of the BD Alaris PC Unit, resulting in manual operation of the PC Unit.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6156 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance USDC file format path element token index.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-1847 ‼
📖 Read
via "National Vulnerability Database".
There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attackers can construct attack scenarios, which leads to denial of service.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4886 ‼
📖 Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26222 ‼
📖 Read
via "National Vulnerability Database".
Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25151 ‼
📖 Read
via "National Vulnerability Database".
The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50 (all versions).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25557 ‼
📖 Read
via "National Vulnerability Database".
In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the application, attacker's code will be run. As a result of this vulnerability, authenticated user can run command on the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21667 ‼
📖 Read
via "National Vulnerability Database".
In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6147 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6019 ‼
📖 Read
via "National Vulnerability Database".
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6149 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6155 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8582 ‼
📖 Read
via "National Vulnerability Database".
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6150 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26825 ‼
📖 Read
via "National Vulnerability Database".
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-9127 ‼
📖 Read
via "National Vulnerability Database".
Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.📖 Read
via "National Vulnerability Database".