CVE-2020-7303

CVE-2020-7303 is a cross-site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension, exploitable pre-11.5.3. An authenticated remote user can trigger client-side scripts in another user's browser by adding a new label, leading to potential cookie/session data exposure or UI s...

CVE-2020-7302

CVE-2020-7302 describes an issue in the McAfee Data Loss Prevention (DLP) ePO extension for McAfee ePolicy Orchestrator. The vulnerability is an Unrestricted Upload of a File with a Dangerous Type in the DLP ePO extension prior to version 11.5.3, caused by lack of sanity checking. The impact, as ...

CVE-2020-7300

Improper Authorization vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only privileges via carefully constructed HTTP post messages...

CVE-2020-7301

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section...

CVE-2020-7301

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section...

CVE-2020-7301

CVE-2020-7301 concerns the McAfee Data Loss Prevention (DLP) ePO extension prior to version 11.5.3. The vulnerability is a Cross Site Scripting (XSS) flaw within the DLP case management file-upload tab, exploited by authenticated users to trigger alerts. The provided documents confirm the affecte...

CVE-2020-7300

CVE-2020-7300 affects McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3. An improper authorization flaw lets authenticated users with view-only privileges remotely alter configuration via carefully crafted HTTP POST messages. Impact is limited to configuration changes; exploitation ...

CVE-2020-7300 DLP ePO extension - Improper Authorization

Improper Authorization vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only privileges via carefully constructed HTTP post messages...

CVE-2020-17361

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...

CVE-2020-17361

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...

Design/Logic Flaw

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...

CVE-2020-17361

CVE-2020-17361 affects ReadyTalk Avian 1.2.0. The issue is in vm::arrayCopy (classpath-common.h): when a negative length is provided, the method returns silently instead of throwing, which can cause data loss in the destination buffer depending on subsequent use. Notes from connected sources indi...

CVE-2020-17361

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...

PT-2020-14923 · Readytalk · Readytalk Avian

Name of the Vulnerable Software and Affected Versions: ReadyTalk Avian version 1.2.0 Description: An issue was discovered in the vm::arrayCopy method defined in classpath-common.h, which returns silently when a negative length is provided, instead of throwing an exception. This could result in da...

Avian JVM 1.2.0 Silent Return

Vulnerability title: Avian JVM vm::arrayCopy silent return on negative length Author: Pietro Oliva CVE: CVE-2020-17361 Vendor: ReadyTalk Product: Avian JVM Affected version: 1.2.0 Description: The issue is located in the vm::arrayCopy method defined in classpath-common.h, where multiple boundary...

chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile

Miroslav Lichvar reports: chrony-3.5.1 ... fixes a security issue in writing of the pidfile. When chronyd is configured to save the pidfile in a directory where the chrony user has write permissions e.g. /var/run/chrony - the default since chrony-3.4, an attacker that compromised the chrony user...

Possible pod name collisions in jupyterhub-kubespawner

Impact What kind of vulnerability is it? Who is impacted? JupyterHub deployments using: - KubeSpawner = 0.11.1 e.g. zero-to-jupyterhub 0.9.0 and - enabled namedservers not default, and - an Authenticator that allows: - usernames with hyphens or other characters that require escape e.g. user-hyphe...

Preventing data loss and mitigating risk in today’s remote work environment

The shift to remote work over the past few months has increased the need for organizations to re-evaluate their security and risk management practices. With employees accessing corporate data at times on home computers or sharing and collaborating in new ways, organizations could be at greater ri...

curl: curl overwrites local file with -J option if file non-readable, but file writable.

Summary: When using -J -O options on curl command line tool and a server responding with a header that is using Content-Disposition to provide a filename, existing local file will be overwritten if the file is non-readable by the current user, but file is writable by the current user. Curl contai...

Survey: Employee Security Training is Essential to Remote Working Success

Organisations have been forced to adapt rapidly over the past few months as government lockdowns kept most workers to their homes. For many, the changes they’ve made may even become permanent as more distributed working becomes the norm. This has major implications for cybersecurity. Employees ar...