‼ CVE-2020-4006 ‼
📖 Read
via "National Vulnerability Database".
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28991 ‼
📖 Read
via "National Vulnerability Database".
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15928 ‼
📖 Read
via "National Vulnerability Database".
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28348 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15929 ‼
📖 Read
via "National Vulnerability Database".
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags, leading to Remote Code Execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26890 ‼
📖 Read
via "National Vulnerability Database".
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-20925 ‼
📖 Read
via "National Vulnerability Database".
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions prior to 3.6.15; v3.4 versions prior to 3.4.24.📖 Read
via "National Vulnerability Database".
🛠 Sifter 11-R2 🛠
📖 Read
via "Packet Storm Security".
Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Sifter 11-R2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 GNU Privacy Guard 2.2.25 🛠
📖 Read
via "Packet Storm Security".
GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.📖 Read
via "Packet Storm Security".
Packetstormsecurity
GNU Privacy Guard 2.2.25 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 nfstream 6.2.4 🛠
📖 Read
via "Packet Storm Security".
nfstream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments.📖 Read
via "Packet Storm Security".
Packetstormsecurity
nfstream 6.2.4 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ Blackrota Golang Backdoor Packs Heavy Obfuscation Punch ❌
📖 Read
via "Threat Post".
Blackrota is targeting a security bug in Docker, but is nearly impossible to reverse-analyze.📖 Read
via "Threat Post".
Threat Post
Blackrota Golang Backdoor Packs Heavy Obfuscation Punch
Blackrota is targeting a security bug in Docker, but is nearly impossible to reverse-analyze.
🕴 Printers' Cybersecurity Threats Too Often Ignored 🕴
📖 Read
via "Dark Reading".
Remote workforce heightens the need to protect printing systems against intrusion and compromise.📖 Read
via "Dark Reading".
Dark Reading
Printers' Cybersecurity Threats Too Often Ignored
Remote workforce heightens the need to protect printing systems against intrusion and compromise.
🦿 Baidu Android apps caught leaking sensitive data from devices 🦿
📖 Read
via "Tech Republic".
Capturing the phone's IMSI number and MAC address, the leaked data could have made users trackable, potentially over their lifetimes, says Palo Alto Networks.📖 Read
via "Tech Republic".
TechRepublic
Baidu Android apps caught leaking sensitive data from devices
Capturing the phone's IMSI number and MAC address, the leaked data could have made users trackable, potentially over their lifetimes, says Palo Alto Networks.
⚠ Naked Security Live – Beat the Threat! ⚠
📖 Read
via "Naked Security".
Here's the latest Naked Security Live video - how to beat the crooks! Watch now...📖 Read
via "Naked Security".
Naked Security
Naked Security Live – Beat the Threat!
Here’s the latest Naked Security Live video – how to beat the crooks! Watch now…
‼ CVE-2020-4002 ‼
📖 Read
via "National Vulnerability Database".
The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way. An authenticated SD-WAN Orchestrator user with high privileges may be able to execute arbitrary code on the underlying operating system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4003 ‼
📖 Read
via "National Vulnerability Database".
VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attacks allowing for potential information disclosure. An authenticated SD-WAN Orchestrator user may inject code into SQL queries which may lead to information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29006 ‼
📖 Read
via "National Vulnerability Database".
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25472 ‼
📖 Read
via "National Vulnerability Database".
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3985 ‼
📖 Read
via "National Vulnerability Database".
The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25473 ‼
📖 Read
via "National Vulnerability Database".
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25474 ‼
📖 Read
via "National Vulnerability Database".
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.📖 Read
via "National Vulnerability Database".