‼ CVE-2020-27192 ‼
📖 Read
via "National Vulnerability Database".
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25705 ‼
📖 Read
via "National Vulnerability Database".
A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions before 5.10 may be vulnerable to this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13358 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13354 ‼
📖 Read
via "National Vulnerability Database".
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-10776 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-11860 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14389 ‼
📖 Read
via "National Vulnerability Database".
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26406 ‼
📖 Read
via "National Vulnerability Database".
Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25833 ‼
📖 Read
via "National Vulnerability Database".
Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack.📖 Read
via "National Vulnerability Database".
❌ Some Apple Apps on macOS Big Sur Bypass Content Filters, VPNs ❌
📖 Read
via "Threat Post".
Attackers can exploit the feature and send people’s data directly to remote servers, posing a privacy and security risk, researchers said.📖 Read
via "Threat Post".
Threat Post
Some Apple Apps on macOS Big Sur Bypass Content Filters, VPNs
Malware can easily exploit the feature and send people’s data directly to remote servers, posing a massive privacy and security risk, researchers said.
🕴 Ransomware Operator Promotes Distributed Storage for Stolen Data 🕴
📖 Read
via "Dark Reading".
The criminals behind the DarkSide ransomware-as-a-service operation say the system will be harder to take down.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Operator Promotes Distributed Storage for Stolen Data
The criminals behind the DarkSide ransomware-as-a-service operation say the system will be harder to take down.
‼ CVE-2020-28687 ‼
📖 Read
via "National Vulnerability Database".
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7774 ‼
📖 Read
via "National Vulnerability Database".
This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25746 ‼
📖 Read
via "National Vulnerability Database".
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28647 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7841 ‼
📖 Read
via "National Vulnerability Database".
Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto://📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28688 ‼
📖 Read
via "National Vulnerability Database".
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.📖 Read
via "National Vulnerability Database".
❌ Cisco Patches Critical Flaw After PoC Exploit Code Release ❌
📖 Read
via "Threat Post".
A critical path-traversal flaw (CVE-2020-27130) exists in Cisco Security Manager that lays bare sensitive information to remote, unauthenticated attackers.📖 Read
via "Threat Post".
Threat Post
Cisco Patches Critical Flaw After PoC Exploit Code Release
A critical path-traversal flaw (CVE-2020-27130) exists in Cisco Security Manager that lays bare sensitive information to remote, unauthenticated attackers.
🕴 An Inside Look at an Account Takeover 🕴
📖 Read
via "Dark Reading".
AI threat find: Phishing attack slips through email gateway and leads to large-scale compromise.📖 Read
via "Dark Reading".
Dark Reading
An Inside Look at an Account Takeover
AI threat find: Phishing attack slips through email gateway and leads to large-scale compromise.
🛠 GNU Privacy Guard 2.2.24 🛠
📖 Read
via "Packet Storm Security".
GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.📖 Read
via "Packet Storm Security".
Packetstormsecurity
GNU Privacy Guard 2.2.24 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 Security Risks Discovered in Tesla Backup Gateway 🕴
📖 Read
via "Dark Reading".
Cybersecurity researchers report on the security and privacy risks of leaving a Tesla Backup Gateway exposed to the Internet.📖 Read
via "Dark Reading".
Dark Reading
Security Risks Discovered in Tesla Backup Gateway
Cybersecurity researchers report on the security and privacy risks of leaving a Tesla Backup Gateway exposed to the Internet.