Google Rolls Out Fixes for High-Severity Android System Flaws

Google has released patches addressing high-severity flaws in its System component. The flaws could be remotely exploited to gain access to additional permissions. Overall, 50 flaws were patched as part of Google’s October security update for the Android operating system, released on Monday. As...

Facebook 'SilentFade' Malware Attack Stole Credentials For Years

Facebook has detailed a wide-scale Chinese malware campaign that targeted its ad platform for years and siphoned $4 million from users’ advertising accounts. The campaign was addressed by the social media’s security teams after it first became active. Dubbed SilentFade short for “Silently running...

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary...

Huawei EulerOS: Security Advisory for icu (EulerOS-SA-2020-2099)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-19455

SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/comjdownloads/helpers/categories.php, order function via the filterorder parameter...

Framer Preview 12 Content Injection Vulnerability

Framer Preview version 12 for Android exposes an activity to other apps called "com.framer.viewer.FramerViewActivity". The purpose of this activity is to show contents of a given URL via an fullscreen overlay to the app user. However, the app does neither enforce any authorization schema on the...

CVE-2020-25735

webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/addannouncement.php, administration/departments.php, administration/locations.php, expenses/claimtype.php, projects/editproject.php, and general/newnotifications.php...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 8 that is used by IBM eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in Jul 2020. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified...

ZTE Router F602W Information Disclosure Vulnerability

ZTE Router is a wireless router device from ZTE. An information disclosure vulnerability exists in the ZTE Router F602W product, which originates from errors such as configuration during operation of the network system or product. An unauthorized attacker can exploit the vulnerability to obtain...

Cross-site Scripting (XSS) - Generic in forkcms/forkcms

Description ForkCMS is an easy to use open source CMS using Symfony Components this package is vulnerable to Stored Cross-Site Scripting XSS. https://github.com/forkcms/forkcms Steps To Reproduce-: 1 install https://github.com/forkcms/forkcms locally or https://demo.fork-cms.com/private/ use demo...

Android Security Bulletin—September 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-09-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

The vulnerability of the Cisco NX-OS network operating system in Cisco devices allows a attacker to trigger a service failure.

The vulnerability of the Cisco NX-OS network operating system in Cisco Fabric Services components is related to the assignment of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2020-25020

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...

PT-2020-5503 · Mpxj · Mpxj

Name of the Vulnerable Software and Affected Versions: MPXJ versions 8.1.3 and earlier Description: The issue is related to the incorrect restriction of XML external entity references in the GanttProjectReader and PhoenixReader components of the MPXJ library. This can allow a remote attacker to...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager (CVE-2019-2949).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle October 2019 Critical Patch Update, but deferred until the release associated with the Oracle April 2020 Critical Patch...

The vulnerability of Windows CDP user components in the Windows operating system, related to errors in memory object handling, allows attackers to exploit their privileges.

The vulnerability of Windows CDP user components in the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges by running a specially created application...

Red Lion N-Tron 702-W, 702M12-W

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Red Lion Equipment: N-Tron 702-W / 702M12-W Vulnerabilities: Reflected Cross-site Scripting, Stored Cross-site Scripting, Cross-site Request Forgery, Hidden Functionality, Use of Unmaintained...

Design/Logic Flaw

Cloud Foundry CAPI Cloud Controller, versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain which is true in the default CF Deployment manifest, were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially...

CVE-2020-1562

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafte...

CVE-2020-1562

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafte...