Code injection

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

CVE-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Watch out: New Android spyware records your calls covertly

By Sudais Asif The group behind this Android spyware is APT-C-23 that has been targeting Palestine since 2017. This is a post from HackRead.com Read the original post: Watch out: New Android spyware records your calls covertly...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

In the Linux kernel before 5.5.8 get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field which might allow attackers to trigger kernel stack corruption via crafted system calls.

...

CVE-2019-16007

A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service hijack attack on an affected device or cause a denial of service DoS condition. The vulnerability is due to the use of...

Authentication flaw

A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to missing authentication on some of the API calls. An attacker could exploit this vulnerabili...

Heap Buffer Over-read

binutils:bionic is vulnerable to heap buffer over-read in dexpression1 in cp-demangle.c after many recursive calls...

Denial Of Service (DoS)

binutils:bionic is vulnerable to denial of service DoS. It is a stack consumption issue in dcounttemplatesscopes in cp-demangle.c after many recursive calls...

The vulnerability of the API subsystem of the Cisco Meeting Server platform allows a hacker to obtain server credentials for conducting audio/video calls and packet forwarding.

The vulnerability of the API subsystem of the Cisco Meeting Server platform relates to insufficient mechanisms for protecting the server’s credentials. This vulnerability allows a malicious actor to obtain the server’s credentials, enabling them to conduct audio/video calls and packet forwarding...

Exploit for CVE-2020-1472

!Pythonpython-shield CVE-2020-1472 CVE-2020-1472 - Zero...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted constructor bodies

Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

CVE-2020-7381

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Securit...

340 weak JWT secrets you should check in your code

JSON Web Token JWT is the data format with bill-in signature and encryption mechanisms that are often used by modern web applications to store user sessions and application context, including authentication by SSO and meta-data. Usually, you can find JWT tokens in an Authentication Bearer HTTP...

CVE-2020-8244

A buffer over-read vulnerability exists in bl 4.0.3, 3.0.1, 2.2.1, and 1.2.3 which could allow an attacker to supply user input even typed that if it ends up in consume argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via...

Huawei EulerOS: Security Advisory for ibus (EulerOS-SA-2020-1855)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Advantech iView NetworkServlet findUpdateDeviceListExport Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the findUpdateDeviceListExport method of the NetworkServlet...

Robocall Results from a Telephony Honeypot

A group of researchers set up a telephony honeypot and tracked robocall behavior: NCSU researchers said they ran 66,606 telephone lines between March 2019 and January 2020, during which time they said to have received 1,481,201 unsolicited calls -- even if they never made their phone numbers publ...