Sony VAIO Update has an unspecified vulnerability

Sony VAIO Update is a system update utility that comes pre-installed in Sony VAIO computers from Sony Japan. A security vulnerability exists in Sony VAIO Update 7.3.0.03150 and prior versions, which stems from the program not properly validating downloaded files. An attacker could exploit the...

Lenovo Service Bridge Vulnerabilities - Lenovo Support US

No description provided...

WhatBreach - OSINT Tool To Find Breached Emails And Databases

WhatBreach is a tool to search for breached emails and their corresponding database. It takes either a single email or a list of emails and searches them leveraging haveibeenpwned.com's API, from there if there are any breaches it will search for the query link on Dehashed pertaining to the...

WordPress Easy Digital Downloads plugin <= 2.9.15 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found in WordPress Easy Digital Downloads plugin versions = 2.9.15. Solution Update the WordPress Easy Digital Downloads plugin to the latest available version at least 2.9.16...

Easy Digital Downloads <= 2.9.15 - Stored XSS

Stored XSS Cross Site Scripting via the IP addresses in logs...

Unauthorized File Access

Overview Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later. References GitHub...

CVE-2019-6800

In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands...

Avengers: Endgame Sites Promise Digital Downloads, Deliver Info-Harvesting

Marvel Studio’s long-awaited superhero juggernaut Avengers: Endgame, represents the second-largest worldwide box-office haul for any film, ever – raking in $2.2 billion in its first two weekends. With demand like that, perhaps it’s not surprising that enterprising scammers are already luring in...

Access Controls Bypass

Mozilla Thunderbird is vulnerable to access controls bypass. File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. Malicious sites could lure users into...

HPSBPI03613 rev. 1 - HP DeskJet 3630 Printers - Cross Site Request Forgery

Potential Security Impact Denial of Service Source: HP, HP Product Security Response Team PSRT Reported By: Tim Coen VULNERABILITY SUMMARY Certain HP DeskJet 3630 All-in-One Printers have a Cross Site Request Forgery CSRF vulnerability that could lead to a denial of service DOS or device...

CVE-2019-3719

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary...

PT-2019-16962 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery SSRF attacks. SS...

Popular Video Editing Software Website Hacked to Spread Banking Trojan

If you have downloaded the VSDC multimedia editing software between late February to late March this year, there are high chances that your computer has been infected with a banking trojan and an information stealer. The official website of the VSDC software — one of the most popular, free video...

DEBIAN-CVE-2019-11065

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site...

Design/Logic Flaw

UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks...

Telerik Web UI Information Disclosure (CVE-2017-9248)

A security bypass vulnerability exists in Telerik Web UI. Successful exploitation of this vulnerability can lead to cross-site scripting, arbitrary file uploads and downloads, leak of MachineKey and compromise of the ASP.NET ViewState on the affected system...

Xoops 1.0.2 PD-Links 1.0 Database Disclosure

Exploit Title : Xoops 1.0.2 PD-Links Modules 1.0 Krobi Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 03/03/2019 Vendor Homepage : xoops.org power-dreams.com Software Download Link : xoops.org/modules/repository/visit.php?cid=40&lid=1491...

GHSA-JH5W-6964-X5CF chromedriver Downloads Resources over HTTP

Affected versions of chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary fil...

closure-util downloads Resources over HTTP

Affected versions of closure-util insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

GHSA-87G3-X896-W798 Downloads Resources over HTTP in atom-node-module-installer

Affected versions of atom-node-module-installer insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...