3813 matches found
RLSA-2020:4059 Important: virt:rhel security update
Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting wi...
Akamai Identified as a Leader Among Zero Trust Providers by Independent Research Firm
We are pleased to share that Akamai has been identified as a Leader in The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q3 2020. In the report, Forrester evaluated how each vendor's portfolio maps and delivers on specific components of the Zero Trust eXtended ZTX framework...
Fuzzing Image Parsing in Windows, Part One: Color Profiles
Image parsing and rendering are basic features of any modern operating system OS. Image parsing is an easily accessible attack surface, and a vulnerability that may lead to remote code execution or information disclosure in such a feature is valuable to attackers. In this multi-part blog series, ...
PT-2020-6311
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 89.0.4389.72 Description The issue is related to an inappropriate implementation in performance APIs, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could potentially lead to...
Google Android Java network APIs Authorization Issues Vulnerability
Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An authorization issue vulnerability exists in the Java network APIs of Android-11. The vulnerability stems from a lack of permission checking, which allows an attacker to access sensitive networ...
CVE-2020-0293
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID:...
CVE-2020-0293
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID:...
Information disclosure
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID:...
CVE-2020-0293
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID:...
CVE-2020-0293
CVE-2020-0293 affects Android 11 via the Java network APIs where a missing permission check can allow access to sensitive network state, leading to local information disclosure without extra execution privileges. The vulnerability is described as requiring no user interaction for exploitation and...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft
This is a PoC exploit for CVE-2020-0796, a buffer overflow vulne...
CVE-2020-0293: Missing Authorization
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID:...
PT-2020-11647
Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue concerns a missing permission check in Java network APIs, potentially allowing access to sensitive network state. This could lead to local information disclosure without requiring additional...
Office 365 Phishing Attack Leverages Real-Time Active Directory Validation
Researchers have uncovered a phishing attack using a new technique: Attackers are making use of authentication APIs to validate victims’ Office 365 credentials – in real time – as they enter them into the landing page. Authentication APIs are used by apps and services running on the users’ behalf...
CVE-2020-1595
A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm...
Important: Red Hat Security Advisory: openstack-nova security update
An update for openstack-nova is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
NaCl Is Not a High-Level API
When talking about high-level application cryptography APIs I usually hear mentioned libsodium, Tink, pyca/cryptography, and NaCl. One of these things is not like the others! The value NaCl had 10 years ago was that it was an opinionated library at a time when all cryptography libraries were...
Exporting Nginx Access Logs to an ELK Cluster
The Wallarm WAF provides an organization with the ability to protect their applications and APIs against a wide range of attacks. However, an organization may wish to achieve a greater degree of visibility into attack traffic and alerts than is possible via the Wallarm user interface. The Wallarm...