15795 matches found
CVE-2019-16000 Cisco Umbrella Roaming Client for Windows Install Vulnerability
A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...
CVE-2019-16000
CVE-2019-16000 affects the Cisco Umbrella Roaming Client for Windows. The issue is in the automatic update process where Windows Installer verification is insufficient, allowing an authenticated, local attacker to place a file in a specific location and bypass policy to install unapproved applica...
Microphone device at Linux endpoint is not redirected to HDX Session
When using Linux endpoint to connect HDX session, user might find that client-side microphone device is not redirected to HDX Session and media applications running in the HDX Session also cannot detect any microphone device, e.g. in Windows Control Panel Sound "Recording" tab, there is no any...
The vulnerability of the Popups component of the Oracle Applications Framework software platform allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.
The vulnerability of the Popups component in the Oracle Applications Framework exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information...
SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2020-52934)
SAP NetWeaver is an integrated application platform based on professional standards that dramatically reduces the complexity of system integration. Its components include portals, application servers, business intelligence solutions as well as system integration and data integration technologies....
SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2020-53173)
SAP 3D Visual Enterprise Viewer is a free 3D visualization viewer for Windows. An input validation error vulnerability exists in SAP 3D Visual Enterprise Viewer 9, which can be exploited by an attacker via a specially crafted SKP file to cause the application to crash...
MFA Bypass Bugs Opened Microsoft 365 to Attack
Bugs in the multi-factor authentication system used by Microsoft’s cloud-based office productivity platform, Microsoft 365, opened the door for hackers to access cloud applications via a bypass of the security system, according to researchers at Proofpoint. The flaws exist in the implementation o...
Exploit for Deserialization of Untrusted Data in Redhat Data_Grid
This is a collection of Java deserialization exploits, specifically targeting various Java applications. The exploits are designed to bypass Java's deserialization security features and execute arbitrary code on the target system. The exploits are implemented in Python and use the ysoserial libra...
A "DFUR-ent" Perspective on Threat Modeling and Application Log Forensic Analysis
Many organizations operating in e-commerce, hospitality, healthcare, managed services, and other service industries rely on web applications. And buried within the application logs may be the potential discovery of fraudulent use and/or compromise! But, let's face it, finding evil in application...
CVE-2020-25250
An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client applications can write arbitrary data to the server logs...
Design/Logic Flaw
An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client applications can write arbitrary data to the server logs...
Top Security and Data Privacy Regulations for Financial Services
Regulatory compliance has become an increasingly more important part of the financial services industry in recent years. And it’s a trend that’s likely to continue due to the upsurge in cloud computing, the use of mobile applications, and a shift to IoT devices, all of which are driving exponenti...
Microsoft Windows/Windows Server Denial of Service Vulnerability (CNVD-2021-66068)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in Microsoft Windows/Windows Server, which...
Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68744)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server, which stems from a...
Microsoft Windows/Windows Server Denial of Service Vulnerability (CNVD-2021-66067)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. A denial of service vulnerability exists in Microsoft Windows/Windows Server. The vulnerability stems from...
Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90799)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server, which stems from a...
CVE-2020-1913
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes...
Design/Logic Flaw
An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...
CVE-2020-1913
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes...
CVE-2020-1912
An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...