WP Accessibility < 1.7.0 - Minor Authenticated Stored XSS in custom CSS

A minor authenticated stored XSS vulnerability was found in the "Styles for Skiplinks when they have focus" section of the WP Accessibility plugin. PoC 1 Navigate to the Settings page of the plugin https://example.com/wp-admin/options-general.php?page=wp-accessibility/wp-accessibility.php 2 Selec...

WP Accessibility < 1.7.0 - Minor Authenticated Stored XSS in custom CSS

A minor authenticated stored XSS vulnerability was found in the "Styles for Skiplinks when they have focus" section of the WP Accessibility plugin. 1 Navigate to the Settings page of the plugin https://example.com/wp-admin/options-general.php?page=wp-accessibility/wp-accessibility.php 2 Select th...

Unable to access SDWAN management GUI once after upgrading to 11.0.2 and the Device is rebooted

You will experience the GUI accessibility issue when you upgrade SDWAN appliance to 11.0.2 version and when it gets rebooted either automatically or manually...

Important: thunderbird

Issue Overview: Several memory safety bugs were discovered in Mozilla Firefox and Thunderbird. Memory corruption and arbitrary code execution are possible with these vulnerabilities. These bugs can be exploited over the network.CVE-2019-11764 A flaw was discovered in both Firefox and Thunderbird...

The vulnerability of the Oilpan component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Oilpan component in the Google Chrome browser is caused by synchronization errors when using a common resource. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a...

The vulnerability of the Blink component in Google Chrome allows a hacker to circumvent domain restriction rules and impact the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Blink component in Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to circumvent domain restriction rules and compromise the confidentiality, integrity, and accessibility of protected information...

GitLab: Steal private objects of other projects via project import

Summary An attacker could transfer issues, merge requests of another project to the imported project by importing a crafted GitLab export. Steps to reproduce 1. Import the attached tarball as GitLab export. 2. Check the issues page of the imported project. You will see an private issue created by...

CVE-2019-15458

The Samsung J7 Neo Android device with a build fingerprint of samsung/j7veltedx/j7velte:8.1.0/M1AJQ/J701FXXS6BSC1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-installed apps...

CVE-2019-15458

The CVE-2019-15458 entry concerns Samsung J7 Neo (Android 8.1.0, build samsung/j7veltedx/j7velte:8.1.0) where a pre-installed component in the package com.samsung.android.themecenter (versionCode 7000100, versionName 7.0.1.0) exposes capabilities that allow other pre-installed apps to perform app...

CVE-2019-15433

The CVE-2019-15433 entry concerns Samsung A3 devices running Android 8.0.0 (build fingerprint samsung/a3y17ltedx/a3y17lte:8.0.0/R16NW/A320YDXU4CSB3:user/release-keys). A pre-installed app, com.samsung.android.themecenter (versionCode 7000000, versionName 7.0.0.0), exposes a component that can be ...

Persistence – Accessibility Features

The accessibility features provide additional options on screen keyboards, magnifier, screen reading etc. that could assist people with disabilities to use Windows operating systems easier. However, this functionality can be abused to achieve persistence on a host that RDP is enabled and...

PunBB 1.4.4 Database Disclosure

From https://j.ludost.net/blog/archives/2019/11/11/minorsecurityissueinpunbbwithsqlite/index.html Minor security issue in punbb with SQLite Georgi Guninski security advisory 76, 2019 Running punbb-master from https://github.com/punbb/punbb from Thu 07 Nov 2019 11:23:33 AM UTC Installing on...

Mozilla: Potentially exploitable crash due to 360 Total Security

A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity...

Mozilla: Potentially exploitable crash due to 360 Total Security

A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity...

The vulnerability of the RSLinx Classic dynamic assembly library of communication servers allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the RSLinx Classic dynamic assembly library server is caused by buffer overflow in the stack. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Mozilla: Potentially exploitable crash due to 360 Total Security

A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity...

Mozilla: Potentially exploitable crash due to 360 Total Security

A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity...

October 24, 2019—KB4522355 (OS Build 18362.449)

None None...

Gustuff Android Banker Switches Up Technical Approach

An Instagram-initiated campaign using the Gustuff Android mobile banking trojan has rolled out in October, featuring an updated version of the malware that lowers its detection profile. How the cybercriminals are rolling out the campaign is the same as a previous offensive seen in June, according...

CVE-2019-4572

IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an administrator on the local machine. IBM X-Force ID: 166798...