‼ CVE-2020-7778 ‼
📖 Read
via "National Vulnerability Database".
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7779 ‼
📖 Read
via "National Vulnerability Database".
All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.📖 Read
via "National Vulnerability Database".
❌ Federated Learning: A Therapeutic for what Ails Digital Health ❌
📖 Read
via "Threat Post".
Researchers show the promise of Federated Learning to protect patient privacy and improve healthcare outcomes across the world.📖 Read
via "Threat Post".
Threat Post
Federated Learning: A Therapeutic for what Ails Digital Health
Researchers show the promise of Federated Learning to protect patient privacy and improve healthcare outcomes across the world.
❌ Changing Employee Security Behavior Takes More Than Simple Awareness ❌
📖 Read
via "Threat Post".
Designing a behavioral change program requires an audit of existing security practices and where the sticking points are.📖 Read
via "Threat Post".
Threat Post
Changing Employee Security Behavior Takes More Than Simple Awareness
Designing a behavioral change program requires an audit of existing security practices and where the sticking points are.
⚠ Bzzzzzzt! How safe is that keenly priced digital doorbell? ⚠
📖 Read
via "Naked Security".
How on earth are you supposed to figure out whether that home gadget you just ordered is full of security holes or not?📖 Read
via "Naked Security".
Naked Security
Bzzzzzzt! How safe is that keenly priced digital doorbell?
How on earth are you supposed to figure out whether that home gadget you just ordered is full of security holes or not?
‼ CVE-2020-27662 ‼
📖 Read
via "National Vulnerability Database".
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29043 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27663 ‼
📖 Read
via "National Vulnerability Database".
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29065 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13886 ‼
📖 Read
via "National Vulnerability Database".
Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27207 ‼
📖 Read
via "National Vulnerability Database".
Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29042 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25738 ‼
📖 Read
via "National Vulnerability Database".
CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has credential access, such as a Chrome process that reads credentials from a SQLite database.📖 Read
via "National Vulnerability Database".
🕴 Failing Toward Zero: Why Your Security Needs to Fail to Get Better 🕴
📖 Read
via "Dark Reading".
Each security incident should lead to a successive reduction in future incidences of the same type. Organizations that fail toward zero embrace failure and learn from their mistakes.📖 Read
via "Dark Reading".
Dark Reading
Failing Toward Zero: Why Your Security Needs to Fail to Get Better
Each security incident should lead to a successive reduction in future incidences of the same type. Organizations that fail toward zero embrace failure and learn from their mistakes.
❌ ThreatList: Cyber Monday Looms – But Shoppers Oblivious to Top Retail Threats ❌
📖 Read
via "Threat Post".
Online shoppers are blissfully unaware of credit card skimming threats and malicious shopping apps as they head into this year's Black Friday and Cyber Monday holiday shopping events.📖 Read
via "Threat Post".
Threat Post
ThreatList: Cyber Monday Looms – But Shoppers Oblivious to Top Retail Threats
Online shoppers are blissfully unaware of credit card skimming threats and malicious shopping apps as they head into this year's Black Friday and Cyber Monday holiday shopping events.
❌ Cybersecurity Predictions for 2021: Robot Overlords No, Connected Car Hacks Yes ❌
📖 Read
via "Threat Post".
While 2021 will present evolving threats and new challenges, it will also offer new tools and technologies that will we hope shift the balance towards the defense.📖 Read
via "Threat Post".
Threat Post
Cybersecurity Predictions for 2021: Robot Overlords No, Connected Car Hacks Yes
Gurucul CEO Saryu Nayyar discusses 2021's evolving threats and new challenges — and new tools and technologies that will we hope shift the balance towards the defense.
🕴 5 Signs Someone Might be Taking Advantage of Your Security Goodness 🕴
📖 Read
via "Dark Reading".
Not everyone in a security department is acting in good faith, and they'll do what they can to bypass those who do. Here's how to spot them.📖 Read
via "Dark Reading".
Dark Reading
5 Signs Someone Might be Taking Advantage of Your Security Goodness
Not everyone in a security department is acting in good faith, and they'll do what they can to bypass those who do. Here's how to spot them.
❌ TurkeyBombing Puts New Twist on Zoom Abuse ❌
📖 Read
via "Threat Post".
Threat actors already stole nearly 4,000 credentials before the holiday was even over, according to report.📖 Read
via "Threat Post".
Threat Post
TurkeyBombing Puts New Twist on Zoom Abuse
Threat actors already stole nearly 4,000 credentials before the holiday was even over, according to report.
🕴 Test 🕴
📖 Read
via "Dark Reading".
A security researcher explains the dangers of poor visibility in the cloud and a new strategy to evaluate IAM exposure in Google Cloud Platform.📖 Read
via "Dark Reading".
Dark Reading
Test
A security researcher explains the dangers of poor visibility in the cloud and a new strategy to evaluate IAM exposure in Google Cloud Platform.
‼ CVE-2020-28921 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19873 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.📖 Read
via "National Vulnerability Database".