‼ CVE-2021-3165 ‼
📖 Read
via "National Vulnerability Database".
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3272 ‼
📖 Read
via "National Vulnerability Database".
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.📖 Read
via "National Vulnerability Database".
❌ Apple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update ❌
📖 Read
via "Threat Post".
An anonymous researcher identified bugs in the software’s kernel and WebKit browser engine that are likely part of an exploit chain.📖 Read
via "Threat Post".
Threat Post
Apple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update
An anonymous researcher identified bugs in the software’s kernel and WebKit browser engine that are likely part of an exploit chain.
⚠ Apple critical patches fix in-the-wild iPhone exploits – update now! ⚠
📖 Read
via "Naked Security".
Apple says. "Additional details available soon", which you can translate as "this one took us by surprise". So patch now!📖 Read
via "Naked Security".
Naked Security
Apple critical patches fix in-the-wild iPhone exploits – update now!
Apple says. “Additional details available soon”, which you can translate as “this one took us by surprise”. So patch now!
🦿 How ghost accounts could leave your organization vulnerable to ransomware 🦿
📖 Read
via "Tech Republic".
Active accounts for people who have left your organization are ripe for exploitation, according to Sophos.📖 Read
via "Tech Republic".
🕴 Security's Inevitable Shift to the Edge 🕴
📖 Read
via "Dark Reading".
As the edge becomes the place for DDoS mitigation, Web app security, and other controls, SASE is the management platform to handle them all.📖 Read
via "Dark Reading".
Dark Reading
Security's Inevitable Shift to the Edge
As the edge becomes the place for DDoS mitigation, Web app security, and other controls, SASE is the management platform to handle them all.
‼ CVE-2020-4967 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4816 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36012 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4820 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4628 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4815 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.📖 Read
via "National Vulnerability Database".
🦿 Why Ubuntu 21.04 is an important release, even without GNOME 40 🦿
📖 Read
via "Tech Republic".
Jack Wallen discusses why the upcoming Ubuntu 21.04 is more important than some of its features would imply.📖 Read
via "Tech Republic".
TechRepublic
Why Ubuntu 21.04 is an important release, even without GNOME 40
Jack Wallen discusses why the upcoming Ubuntu 21.04 is more important than some of its features would imply.
‼ CVE-2020-16106 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16105 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16107 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16114 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16108 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23356 ‼
📖 Read
via "National Vulnerability Database".
dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23352 ‼
📖 Read
via "National Vulnerability Database".
Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.📖 Read
via "National Vulnerability Database".