CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

Code injection

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

CVE-2020-17533 Apache Accumulo Improper Handling of Insufficient Permissions

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

CVE-2020-17533

Summary of CVE-2020-17533 (Apache Accumulo) Root cause: Insufficient verification of the return values from policy-enforcement functions canFlush and canPerformSystemActions, allowing an authenticated user with limited permissions to perform restricted administrative operations. Affected versions...

How Your Digital Trails Wind Up in the Police’s Hands

Phone calls. Web searches. Location tracks. Smart speaker requests. They’ve become crucial tools for law enforcement, while users often are unaware...

Law Enforcement Seizes Joker's Stash — Stolen Credit Card Marketplace

The US Federal Bureau of Investigation FBI and Interpol have allegedly seized proxy servers used in connection with Blockchain-based domains belonging to Joker's Stash, a notorious fraud bazaar known for selling compromised payment card data in underground forums. The takedown happened last week ...

Cybercriminals' Favorite Bulletproof VPN Service Shuts Down In Global Action

Law enforcement agencies from the US, Germany, Netherlands, Switzerland, France, along with Europol's European Cybercrime Centre EC3, announced today the coordinated takedown of Safe-Inet, a popular virtual private network VPN service that was used to facilitate criminal activity. The three domai...

Joker's Stash Carding Site Taken Down

Joker’s Stash, the carding site where cybercriminals hawk their payment-card wares, has suffered a blow after law enforcement apparently seized one of its domains. Joker’s Stash is a popular cybercriminal destination that specializes in trading in payment-card data, offering millions of stolen...

Serious vulnerabilities fixed in Dell Wyse ThinOS

Vulnerabilities have been fixed in Dell Wyse ThinOS. A malicious person with access to a local FTP server could exploit the vulnerabilities to obtain sensitive information. The malicious party, by accessing this information and the ability to modify configuration files, the entire system. Dell ha...

Defending Against State and State-Sponsored Threat Actors

Security threats from states and state-sponsored actors have been around since before the field of cybersecurity was defined. They have now evolved to cyberspace, and present unique challenges for defenders. While there are fundamental differences between activist and criminal activity, and those...

Privilege Escalation

chromium is vulnerable to privilege escalation. Insufficient policy enforcement in the Intents allows a local attacker to bypass navigation restrictions via malicious Intents...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. Insufficient policy enforcement in downloads allows a remote attacker, who has tricked a user open files, to execute arbitrary code via a malicious HTML page...

Information Disclosure

chromium, sid is vulnerable to insufficient policy enforcement in extensions in Google Chrome. It allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...

Insufficient Policy Enforcement

Insufficient policy enforcement in intent handling in Google Chrome on Android allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page...

Cross-origin Data Leak

chromium is vulnerable to cross-origin data leak. Insufficient policy enforcement in media in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Authorization Bypass

chromium is vulnerable to authorization bypass. The vulnerability exists through insufficient policy enforcement in intent handling that allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Information Disclosure

chromium is vulnerable to information disclosure. Insufficient policy enforcement in autofill allows a remote attacker to leak cross-origin data via a malicious HTML page...

Content-Security Policy Bypass

chromium is vulnerable to content-security policy bypass. Insufficient policy enforcement in CSP allows a remote attacker to bypass content security policy via a malicious HTML page...

Authorization Bypass

chromium is vulnerable to authorization bypass. An insufficient policy enforcement flaw was found in the developer tools component of the Chromium browser...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. The vulnerability exists through insufficient policy enforcement in ANGLE that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page...