‼ CVE-2020-35592 ‼
📖 Read
via "National Vulnerability Database".
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26717 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3271 ‼
📖 Read
via "National Vulnerability Database".
PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36233 ‼
📖 Read
via "National Vulnerability Database".
The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26906 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.📖 Read
via "National Vulnerability Database".
🕴 CrowdStrike Buys Log Management Startup Humio for $400M 🕴
📖 Read
via "Dark Reading".
CrowdStrike plans to use Humio's technology to continue building out its extended detection and response platform.📖 Read
via "Dark Reading".
Dark Reading
CrowdStrike Buys Log Management Startup Humio for $400M
CrowdStrike plans to use Humio's technology to continue building out its extended detection and response platform.
🕴 Microsoft Concludes Internal Investigation into Solorigate Breach 🕴
📖 Read
via "Dark Reading".
The software giant found no evidence that attackers gained extensive access to services or customer data.📖 Read
via "Dark Reading".
Darkreading
Microsoft Concludes Internal Investigation into Solorigate Breach
The software giant found no evidence that attackers gained extensive access to services or customer data.
‼ CVE-2021-26747 ‼
📖 Read
via "National Vulnerability Database".
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26712 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.📖 Read
via "National Vulnerability Database".
âš S3 Ep20: Corporate megahacking, true love gone bad, and tax grabs [Podcast] âš
📖 Read
via "Naked Security".
Latest episode, listen now! (Includes special gardening safety section at no extra charge!)📖 Read
via "Naked Security".
Naked Security
S3 Ep20: Corporate megahacking, true love gone bad, and tax grabs [Podcast]
Latest episode, listen now! (Includes special gardening safety section at no extra charge!)
‼ CVE-2020-36247 ‼
📖 Read
via "National Vulnerability Database".
Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36251 ‼
📖 Read
via "National Vulnerability Database".
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36249 ‼
📖 Read
via "National Vulnerability Database".
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24908 ‼
📖 Read
via "National Vulnerability Database".
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26296 ‼
📖 Read
via "National Vulnerability Database".
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36250 ‼
📖 Read
via "National Vulnerability Database".
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36248 ‼
📖 Read
via "National Vulnerability Database".
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36252 ‼
📖 Read
via "National Vulnerability Database".
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3339 ‼
📖 Read
via "National Vulnerability Database".
ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-10254 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-10252 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can interact with local services blindly (aka Blind SSRF) or conduct a Denial Of Service attack.📖 Read
via "National Vulnerability Database".