❌ TurkeyBombing Puts New Twist on Zoom Abuse ❌
📖 Read
via "Threat Post".
Threat actors already stole nearly 4,000 credentials before the holiday was even over, according to report.📖 Read
via "Threat Post".
Threat Post
TurkeyBombing Puts New Twist on Zoom Abuse
Threat actors already stole nearly 4,000 credentials before the holiday was even over, according to report.
🕴 Test 🕴
📖 Read
via "Dark Reading".
A security researcher explains the dangers of poor visibility in the cloud and a new strategy to evaluate IAM exposure in Google Cloud Platform.📖 Read
via "Dark Reading".
Dark Reading
Test
A security researcher explains the dangers of poor visibility in the cloud and a new strategy to evaluate IAM exposure in Google Cloud Platform.
‼ CVE-2020-28921 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19873 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19874 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27746 ‼
📖 Read
via "National Vulnerability Database".
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15685 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27745 ‼
📖 Read
via "National Vulnerability Database".
Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15684 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7780 ‼
📖 Read
via "National Vulnerability Database".
This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15680 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15686 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19877 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer, a different vulnerability than CVE-2019-16357.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19875 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15681 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28922 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write arbitrary physical memory. This could lead to arbitrary Ring-0 code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25014 ‼
📖 Read
via "National Vulnerability Database".
A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15682 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15683 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19876 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An EnMon PHP script was vulnerable to SQL injection, a different vulnerability than CVE-2019-10006.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-10772 ‼
📖 Read
via "National Vulnerability Database".
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.📖 Read
via "National Vulnerability Database".