Apple Security Update: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra

Apple recommends to install security update macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra on devices macOS Catalina 10.15.5...

Unauthorized Access Vulnerability in uni-app of Digital Paradise (Beijing) Network Technology Co.

uni-app is a framework for developing all front-end applications using Vue.js, developers write a set of code that can be published to H5, and a variety of small programs WeChat/Alipay/Baidu/Headline/QQ/Pin/Nail/Taobao, fast apps and other platforms, and can be directly packaged in HBuilderX to...

Apple Security Update: watchOS 5.3.8

Apple recommends to install security update watchOS 5.3.8 on devices Apple Watch Series 1, 2, 3, and 4...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary CVE-2019-2949 deferred from Oracle Oct 2019 CPU Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality...

Debian: Security Advisory (DSA-4722-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-15299

A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...

openSUSE: Security Advisory for live555 (openSUSE-SU-2020:0944-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. As no relevant locks in particular the credguardmutex are held during the ptracemayaccess call, it is possible for the specified target task to perform an execve syscall with setuid execution...

CVE-2020-15529

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks...

SYLKin Malware Infection Attempt

SYLKin is a remote access Trojan malware. Successful infection will allow an attacker to create malicious install scripts on the affected system...

TAU Threat Analysis: Bundlore (macOS) mm-install-macos

The mm-install-macos variant of the Bundlore family of macOS adware has been around for many years in many variations and delivery methods. Recently, a variant with a novel installation method was discovered. Although most of the installation details were the same or similar to the samples analyz...

Screenspy - Capture user screenshots using shortcut file (Bypass SmartScreen/Defender)

Capture user screenshots using shortcut file Bypass SmartScreen/Defender. Suport Multi-monitor Legal disclaimer: Usage of ScreenSpy for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers...

PT-2020-14375 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and 3.1....

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2020-1692)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Veeam Backup & Replication — Cannot find any supported licenses for current product version.

Challenge When attempting to install a license into Veeam Backup & Replication, the following error occurs: Cannot find any supported licenses for current product version. Cause This error most often occurs when the license file being installed is for an older version of Veeam Backup & Replicatio...

npm: Symlink reference outside of node_modules folder through the bin field upon installation

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2020-5410 Spring Cloud Config directory traversal vulnera...

SUSE-SU-2020:1630-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling SRBDS or 'CrossTalk...

Naviwebs Navigate CMS Code Issue Vulnerability

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A security vulnerability exists in the installfromhash function in Naviwebs Navigate CMS version 2.9, which can be exploited by attackers to compromise confidentiality, integrity, and...