8388 matches found
Qualcomm Audio Input Validation Error Vulnerability
Qualcomm Audio is an audio device software from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Audio where access to global control elements may be out of bounds due to a competitive condition...
Security Bulletin: Vulnerability in WebSphere Application Server Liberty affects IBM Z Development and Test Environment - Jan 2021
Summary There is a vulnerability in WebSphere Application Server Liberty that is used by IBM Z Development and Test Environment. The issue affects WebSphere Application Server Liberty 17.0.0.3 - 20.0.0.10 using the beanValidation-2.0 feature. Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTIO...
Upcoming Rapid7 Webcast: How Far Does Your VRM Strategy Go?
Web applications have been growing in complexity over the past several years, while also becoming the preferred method for attackers looking to capitalize on emergent technologies. This is a trend that will only persist and evolve, so it’s crucial to extend your web application testing strategy t...
Authorization Bypass
chromium is vulnerable to arbitrary code execution. An insufficient policy enforcement flaw in the File System API component allows an attacker to bypass access controls...
Authorization Bypass
chromium is vulnerable to authorization bypass. An insufficient policy enforcement flaw in the WebView component allows an attacker to bypass access controls...
Server side request forgery (ssrf)
A vulnerability in the session validation feature of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. This vulnerability is due to insufficient validation of...
CVE-2021-1272 Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability
A vulnerability in the session validation feature of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. This vulnerability is due to insufficient validation of...
Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability
A vulnerability in the session validation feature of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. This vulnerability is due to insufficient validation of...
Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-10693)
Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability affects the Hibernate Validator library used by WebSphere Application Server Liberty. If exploited an attacker could bypass input sanitation...
IBM MQ 9.0.0.0 LTS / 9.0.1 CD (560861)
The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926. Note that...
PT-2021-1742 · Oracle · Oracle Complex Maintenance
Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 11.5.10, 12.1, 12.2 Description: The issue is related to insufficient access control in the Dialog Box component of the Oracle Complex Maintenance, Repair, and Overhaul product. This...
NSA Releases Guidance on Encrypted DNS in Enterprise Environments
The National Security Agency NSA has released an information sheet with guidance on adopting encrypted Domain Name System DNS over Hypertext Transfer Protocol over Transport Layer Security HTTPS, referred to as DNS over HTTPS DoH. When configured appropriately, strong enterprise DNS controls can...
TikTok Takes Teen Accounts Private
TikTok has decided to boost privacy measures for its underage users, the popular video-sharing social-media company announced. TikTok’s popularity is being driven by teens — the company reported in 2019 about 60 percent of its 26.5 monthly users are between the ages of 16 and 24, and these latest...
PT-2021-1569 · Microsoft · Windows Multipoint Management +1
Name of the Vulnerable Software and Affected Versions: Windows Multipoint Management affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Multipoint Management service, which can be exploited to elevate privileges. This could allow a...
PT-2021-1564 · Microsoft · Windows Hyper-V +1
Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient access controls in the Windows Hyper-V hardware virtualization system, allowing an attacker to potentially elevate their privileges. An...
CVE-2020-16022
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...
Design/Logic Flaw
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...
CVE-2020-16022
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...
