CVE-2020-12448

GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet...

CVE-2020-12448

Removed by vendor...

Khan Academy: Unauthorised Account Detail Modification

Introduction ========= Hi 5kyw41k3r here, ==I found an Unauthorised Account Detail Modification in KA website==... Defination ========= It is a flaw which allows a malicious actor to modify the details of an account. I have included a video made by me for demonstration purposes using a test...

The vulnerability of the agroot() function in the Graphviz visualization application, which allows a hacker to cause a service failure

The vulnerability of the agroot function in the Graphviz visualization application is related to pointer dereferencing errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...

iOS Mail bug allows remote zero-click attacks

On Monday, ZecOps released a report about a couple concerning vulnerabilities with the Mail app in iOS. These vulnerabilities would allow an attacker to execute arbitrary code in the Mail app or the maild process that assists the Mail app behind the scenes. Most concerning, though, is the fact th...

GHSA-XFQH-7356-VQJJ Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information...

Code injection

The Synergy Systems & Solutions SSS HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Actor CWE-200 vulnerability. The affected product is vulnerable to information exposure over the SNMP protocol. This is a different issue than...

Critical VMware Bug Opens Up Corporate Treasure to Hackers

A critical information-disclosure bug in VMware’s Directory Service vmdir could lay bare the contents of entire corporate virtual infrastructures, if exploited by cyberattackers. The vmdir is part of VMware’s vCenter Server product, which provides centralized management of virtualized hosts and...

The vulnerability of Huawei’s microprogrammed router software, related to resource exhaustion, allows a hacker to trigger a service failure.

The vulnerability of Huawei’s microprogrammed router software is related to resource exhaustion. Exploiting this vulnerability can allow a malicious actor to cause service failures...

It’s Your Money and They Want It Now — The Cycle of Adversary Pursuit

When we discover new intrusions, we ask ourselves questions that will help us understand the totality of the activity set. How common is this activity? Is there anything unique or special about this malware or campaign? What is new and what is old in terms of TTPs or infrastructure? Is this being...

Code injection

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

CVE-2020-7599

CVE-2020-7599 affects the Gradle plugin com.gradle.plugin-publish prior to 0.11.0. When a plugin is published with Gradle running at --info, the Gradle Logger may expose an AWS pre-signed URL in build logs. If such logs are publicly accessible, an attacker could leverage the URL to replace a rece...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Improper access control

HUAWEI smartphones P30 with versions earlier than 10.0.0.185C00E85R1P11 have an improper access control vulnerability. The software incorrectly restricts access to a function interface from an unauthorized actor, the attacker tricks the user into installing a crafted application, successful explo...

This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits

Beginning this year, FireEye observed Chinese actor APT41 carry out one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years. Between January 20 and March 11, FireEye observed APT41 attempt to exploit vulnerabilities in Citrix NetScaler/ADC, Cisco routers,...

Information disclosure

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other more complex ways...

New Mirai Variant 'Mukashi' Targets Zyxel NAS Devices

Another variant of the shape-shifting Mirai botnet is attacking Zyxel network-attached storage NAS devices using a critical vulnerability that was only recently discovered, according to security researchers. The variant, dubbed Mukashi, takes advantage of a pre-authentication command injection...

CVE-2019-16070

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs...

CVE-2019-16070

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs...

CVE-2019-16070

NETSAS Enigma NMS 65.0.0 and earlier contains stored XSS vulnerabilities (CVE-2019-16070) in the WEB application, exploitable through web form inputs. Root cause per sources: lack/insufficient validation of client-side data in the web app. Impact described as client-side code execution; CVSS data...