PT-2020-14542 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information without requiring authentication. The flaw exists in the ajax list accounts.php file, specifically when parsing the...

PT-2020-14543 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...

PT-2020-14540 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax list accounts.php file,...

PT-2020-14142 · Supermicro · Supermicro X10Drh-It

Name of the Vulnerable Software and Affected Versions: Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware version 03.40 Description: The issue allows remote attackers to exploit a CSRF problem in the cgi/config user.cgi file through the web interface, enabling them to add...

CVE-2020-14944

Global RADAR BSA Radar 1.6.7234.24750 and earlier exposes ChangePassword, SaveUserProfile, and GetUser without proper authorization, enabling manipulation and potential takeover of user accounts. Exploitation details in connected sources show a Cross-Site Request Forgery/authorization bypass enab...

Courier: Missing rate limit in signup Form

Hello Team , Description When signing up for an account, you enter your email. When this email is already in use, the server responds with "UserConfirmed":true,"UserSub":"ae294fff-6d55-407d-9676-1f3518029037" This in not a problem, but the fact that you could send this request unlimited times is...

CVE-2020-3245

A vulnerability in the web application of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this...

CVE-2020-3245

A vulnerability in the web application of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this...

CVE-2020-3245

The CVE-2020-3245 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) in its web application. A lack of authorization controls allows an unauthenticated, remote attacker to craft HTTP requests that add arbitrary user accounts to the device configuration (these will not be admin or op...

Bot Mafias Have Wreaked Havoc in 'World of Warcraft Classic'

Blizzard has suspended or closed over 74,000 accounts in the last month, as bots have upended the game's economy...

Cisco Smart Software Manager On-Prem Access Control Error Vulnerability

Cisco Smart Software Manager On-Prem SSM On-Prem is a Cisco component for Cisco product license management. An Access Control Error vulnerability exists in web applications in versions prior to Cisco SSM On-Prem Release 8-202004, which stems from a lack of authorization controls. A remote attacke...

Twitter Disrupts Wide-Ranging Political Disinformation Campaigns

Twitter has taken down three separate nation-sponsored influence operations, attributed to the People’s Republic of China PRC, Russia and Turkey. Collectively the operations consisted of 32,242 bogus or bot accounts generating the content and various amplifier accounts that retweeted it. “Every...

Mail.ru: Получение гарантированного дохода и бонусов без фактического исполнения заказов, при этом используя аккаунты не существующих людей.

Reported demonstrated a possibility to bypass an anti-fraud protection in Citymobil taxi service...

CVE-2019-4576

IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166803...

Design/Logic Flaw

IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166803...

CVE-2019-4576

IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166803...

Component Object Model Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Component Object Model COM client uses special case IIDs. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; ...

Electrolux, Others Conned Out of Big Money by BEC Scammer

A 64-year-old business email compromise BEC guru has plead guilty in Houston to bilking appliance giant Electrolux and one other company out of a combined half a million dollars — in addition to other fraud schemes. Kenenty Hwan Kim a.k.a. Myung Kim admitted in federal court the Southern District...

Release information for Veeam Backup for Microsoft 365 4c

NOTE A cumulative patch is now available, click here for more information Veeam Backup for Microsoft 365 4c cumulative patch KB4099. IMPORTANT The GA build of Veeam Backup for Microsoft 365 version 4c build 4.0.1.519 was recalled due to a backup sync issue identified by Veeam quality assurance. I...

The vulnerabilities of Cisco Firepower Management Center’s network management software, related to the rigid encoding of registration data, allow attackers to gain full access to the system.

The vulnerability of Cisco Firepower Management Center’s network management software is related to the rigid coding of registration data. Exploiting these vulnerabilities could allow a malicious actor, operating remotely, to gain full access to the system using a high-privilege account...