CVE-2020-12818

An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed...

CVE-2020-14024

Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...

CVE-2020-14024

CVE-2020-14024 специалисты описывают как у Ozeki NG SMS Gateway до версии 4.17.6 обнаружены несколько XSS-уязвимостей, требующих аутентифицированного доступа: через поля Receiver/Recipient в Mailbox, OZFORM_GROUPNAME в настройках групп адресов, поле listname в Defining Address Lists и через любой...

Incorrect Security Checks

firefox is doing incorrect security checks. Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks...

Design/Logic Flaw

It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMQ Online in an inconsistent state, where the AMQ Online components do not operate properly, such as the failure of provisioning and the failure of creating...

STRONTIUM: Detecting new patterns in credential harvesting

Microsoft has tied STRONTIUM to a newly uncovered pattern of Office365 credential harvesting activity aimed at US and UK organizations directly involved in political elections. Analysts from Microsoft Threat Intelligence Center MSTIC and Microsoft Identity Security have been tracking this new...

Heap overflow

u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle to refer to a particular session and can cause TZ to jump to a invalid address' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...

CVE-2019-14025

CVE-2019-14025 affects Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer IOT/etc.) where, on a new session creation, an Object is returned that contains TZ addresses and is passed to HLOS as a handle to refer to that session. The underlying issue is that this can cause TZ to jump to an...

CVE-2020-3546

A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are se...

CVE-2020-3546

CVE-2020-3546 affects Cisco Email Security Appliance (ESA) running Cisco AsyncOS. The issue stems from insufficient validation of requests to the web-based management interface, allowing an unauthenticated, remote attacker to access sensitive information. Exploitation could disclose IP addresses ...

Command Injection in local-devices

Versions of local-devices prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 3.0.0 or later...

Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

CVE-2020-5622

Shadankun Server Security Type excluding normal blocking method types Ver.1.5.3 and earlier allows remote attackers to cause a denial of service which may result in not being able to add newly detected attack source IP addresses as blocking targets for about 10 minutes via a specially crafted...

Fedora: Security Advisory for bind (FEDORA-2020-14c194e5af)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

"Shadankun Server Security Type" vulnerable to denial-of-service (DoS)

Overview "Shadankun Server Security Type" provided by Cyber Security Cloud , Inc. contains a denial-of-service DoS vulnerability. When "Rule id"s assigned by the product's internal script overlap, it would not be able to add newly detected attack source IP addresses as the blocking targets CWE-70...

JVN#42665874: "Shadankun Server Security Type" vulnerable to denial-of-service (DoS)

"Shadankun Server Security Type" provided by Cyber Security Cloud , Inc. contains a denial-of-service DoS vulnerability. When "Rule id"s assigned by the product's internal script overlap, it would not be able to add newly detected attack source IP addresses as the blocking targets CWE-703. The...

welpwn

This is an exploit module for a vulnerability in a binary, targeting a heap-based buffer overflow. The module is part of the PwnContext framework, which is a Python library for exploitation and reverse engineering. The module is designed to exploit a vulnerability in a binary that allows for a...

DEBIAN-CVE-2020-24972

The Kleopatra component before 3.1.12 and before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL...

CVE-2020-5923

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6 link-local addresses...

CVE-2020-5923

CVE-2020-5923 affects F5 BIG-IP and BIG-IQ self-IP port-lockdown via IPv6 link-local addresses across multiple versions (BIG-IP 11.6.x–16.x, BIG-IQ 5.4–7.0). Root cause is self-IP port-lockdown bypass when accessed through IPv6 link-local addresses. Known vulnerable versions include: BIG-IP 11.6....