Input validation

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

The vulnerability of Check Point Security Gateway’s security gateway allows attackers to circumvent existing access restrictions and carry out spear-phishing attacks.

The vulnerability of Check Point Security Gateway relates to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and carry out spear-phishing attacks...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

CVE-2019-4329

CVE-2019-4329 affects IBM Security Guardium Big Data Intelligence (SonarG) 4.0. The issue arises from incomplete blacklisting in input validation, enabling bypass of application controls and potential impact to system integrity. Public sources (IBM advisory) confirm affected version 4.0 and provi...

Firefox DNS over HTTPS (DoH) and Enterprise Threat Protector

Recursive DNS communications are normally unencrypted between a client and a resolver. In an effort to improve user privacy and address security concerns, Mozilla announced it would begin enabling DNS over HTTPS DoH by default in its Firefox browser. However, Mozilla recognized it would be...

UniCredit Bank Suffers 'Data Incident' Exposing 3 Million Italian Customer Records

UniCredit, an Italian global banking and financial services company, announced today that it suffered a security incident that leaked some personal information belonging to at least 3 million of its domestic customers. Officially founded in 1870, UniCredit is Italy's biggest banking and financial...

Cisco Finesse Appliance Directory Read Information Disclosure Vulnerability (Cisco-SA-20130812-CVE-2013-3457)

According to its self-reported version, the Cisco Finesse appliance is affected by an information disclosure vulnerability due to insufficient access controls. An unauthenticated, remote attacker can exploit this, via a URL point to the open directory, to disclose potentially sensitive informatio...

PT-2019-14903 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable in the file appaccess controlsaccess control nodes.php, which is reflected in HTML. This leads to a cross-site scripting XSS issue, allowi...

PT-2019-3598 · Oracle · Oracle Hospitality Res 3700

Name of the Vulnerable Software and Affected Versions: Oracle Hospitality RES 3700 version 5.7 Description: The issue is related to insufficient access controls in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. It allows a remote attacker to gain full control...

Open-Xchange OX App Suite SSRF / XSS / Information Disclosure / Access Controls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs appsuite, dovecot, powerdns at HackerOne. Yours sincerely...

X (Formerly Twitter): [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the user

I have reported this bug in report 681361 so that you make a FULL fix, but you refused considered duplicate and I have to wait for report 664038 to be resolved, now I come again to report the bug. The settings for "protected tweets" that have been set from another application accidentally change...

CVE-2017-2664

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...

CVE-2019-0057

An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager JDM application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1,...

Authorization

An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager JDM application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1,...

Google Android Media Framework Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple remote-code execution vulnerabilities 2. An information-disclosure vulnerability An attacker can exploit these issues to gain sensitive information, or execute arbitrary code. Failed exploits may result in...

Google Android System Component Multiple Security Vulnerabilities

Description Google Android is prone to multiple security vulnerabilities. An attacker can leverage these issues to gain access to sensitive information or elevated privileges. These issues are being tracked by Android IDs A-123700348, A-124940143 Technologies Affected Google Android 10.0 Google...

NCSC Releases Fact Sheet on DNS Monitoring

The Dutch National Cyber Security Centre NCSC has released a fact sheet on the increasing difficulty of Domain Name System DNS monitoring. NCSC warns that although modernization of transport protocols is helpful, it also makes it more difficult to monitor or modify DNS requests. These changes cou...

Foxit Reader Multiple Vulnerabilities (Oct 2019)

Foxit Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:reader";...

What Is the DoD’s New Cybersecurity Maturity Model Certification, and What Does It Mean for Defense Contractors?

Citing the threat of compromise of Controlled Unclassified Information CUI within the defense industrial base DIB, along with the high cost of cyber breaches in general, the Office of the Assistant Secretary of Defense for Acquisition has initiated a program for rating the cybersecurity maturity ...

PT-2019-3610 · Zingbox · Zingbox Inspector

Name of the Vulnerable Software and Affected Versions: Zingbox Inspector versions 1.294 and earlier Description: A security issue exists due to the lack of protection against ARP spoofing, allowing a remote attacker to potentially elevate their privileges. The issue makes the Inspector susceptibl...