CVE-2020-11999

Rockwell Automation CVE-2020-11999 affects FactoryTalk Linx software versions 6.00/6.10/6.11 and related components (RSLinx Classic, CCS Workbench, ControlFLASH/ControlFLASH Plus, FactoryTalk Asset Centre, Linx CommDTM, Studio/Logix tools). The root cause is improper input validation in an expose...

OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation Vulnerabilities

OX App Suite and OX Documents versions 7.10.3 and below suffer from server-side request forgery, cross site scripting, improper parameter validation, and XML injection vulnerabilities. Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in findi...

CVE-2020-13696

An issue was discovered in LinuxTV xawtv before 3.107. The function devopen in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to...

Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS

A JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. How it works? Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...

components-mart.dk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1180904 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Fedora: Security Advisory for unbound (FEDORA-2020-8e9b62948e)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Valak Loader Revamped to Rob Microsoft Exchange Servers

Threat actors have revamped a popular malware loader into a stealthy infostealer that targets Microsoft Exchange servers to pilfer enterprise mailing information, passwords and enterprise certificates, researchers have found. Security researchers from Cybereason Nocturnus have discovered Valak, a...

The vulnerability of the inter-process interaction components of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free, Kaspersky Security Cloud, Kaspersky Password Manager, Kaspersky Safe Kids, Kaspersky Software Updater, Kaspersky Endpoint Security, Kaspersky Small Office Security, and Kaspersky AntiTargetedAttackAgent allows a perpetrator to execute arbitrary code.

The vulnerability of the inter-process interaction components of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free, Kaspersky Security Cloud, Kaspersky Password Manager, Kaspersky Safe Kids, Kaspersky Software Updater, Kaspersky Endpoint Security, Kaspers...

Kubernetes: DoS for client-go jsonpath func

Summary: jsonpath recursive descent cause a DoS vul kubectl apiextensions-apiserver cli-runtime and kubernetes is depends on client-go I think evalRecursive cause of this vulnerability function pos: client-go/util/jsonpath/jsonpath.go:451 Component Version: client-go:master Steps To Reproduce: i...

Vulnerability of Microsoft Graphics Components in the Windows operating system, allowing attackers to escalate their privileges or execute arbitrary code

The vulnerability of Microsoft Graphics Components in the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code using a specially created application...

Vulnerability of Microsoft Graphics Components of the Windows operating system, allowing a hacker to execute arbitrary code

The vulnerability of Microsoft Graphics Components in the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Server VDA with vGPU hangs when the default hybrid mode graphics (GDI + Direct3D)

On a VDA running on Windows Server 2016, the OS could get into a hung statein a scenario when itis used asa double-hop to other resources and a vGPU is available. This will be observed when wfica32.exe attempts to useGDI +Direct3Drendering called Hybrid mode. The issue was identified as part of O...

CVE-2020-1153

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'...

Remote code execution

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'...

CVE-2020-1153 Microsoft Graphics Components Remote Code Execution Vulnerability

...

CVE-2020-1153

CVE-2020-1153 is a remote code execution vulnerability in the way Microsoft Graphics Components handles objects in memory. The connected MSKB entries reference Windows updates that include security fixes for the Microsoft Graphics Component as part of the May 2020 updates (e.g., KB4556799 and rel...

CVE-2020-9410

The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that...

GHSA-V3XW-C963-F5HC jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

Deserialization of untrusted data

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

Microsoft Windows Graphics Components Remote Code Execution Vulnerability (CNVD-2020-46637)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Graphics Components is one of the graphics components. A remote code execution vulnerabili...