9604 matches found
shrewsbury-events.co.uk Cross Site Scripting vulnerability OBB-1366525
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.
...
CVE-2020-9992
creationtimestamp| type| source ---|---|--- 2020-09-18 06:51:56+00:00| seen| https://t.me/informationsecuritychannel/40439 2020-09-18 13:27:51+00:00| seen| https://t.me/truesecator/952 2022-08-04 16:58:09+00:00| seen| https://t.me/sxcteam/152 2022-09-08 16:14:37+00:00| published-proof-of-concept|...
TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform
Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...
py-matrix-synapse -- malformed events may prevent users from joining federated rooms
Problem Description: Affected Synapse versions assume that all events have an "origin" field set. If an event without the "origin" field is sent into a federated room, servers not already joined to the room will be unable to do so due to failing to fetch the malformed event. Impact: An attacker...
CVE-2020-16099
In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...
Command injection
In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...
CVE-2020-16099
In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...
CVE-2020-16099
Gallagher Command Centre (v8.20, prior to v8.20.1093MR2) is affected by CVE-2020-16099. The vulnerability allows attackers to create Guard Tour events that, when accessed (e.g., via reporting), can cause client applications to temporarily hang or disconnect. Public technical details are limited i...
Information Disclosure
derhansen/sfeventmgt is vulnerable to information disclosure. Missing access checks in the backend module allows an authenticated user to export restricted participant data for events or send emails to event participants for events which the user does not have access to...
Information Disclosure in TYPO3 extension sf_event_mgt
A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...
USN-4488-1 xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 vulnerabilities
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled the input extension protocol. A local attacker could possibly use this issue to escalate privileges. CVE-2020-14346 Jan-Niklas Sohn discovered that the X.Org X Server incorrectly initialized memory. A local attacker could...
@addaps/doca-addaps-theme (>=1.0.1 <=1.0.6), doca-bootstrap-theme (>=0.0.6 <=1.0.0) +11 more potentially affected by unknown CVE via react-marked-markdown (=1.4.6)
react-marked-markdown NPM version =1.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on react-marked-markdown and may be impacted: - @addaps/doca-addaps-theme =1.0.1, =0.0.6, =0.0.1, =0.2.1, =1.0.0, =0.0.1, =1.0.0, =0.1.1, =0.15.1, =0.1.2, =0.2.1 Sour...
CVE-2020-23982
DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'...
Sinter - A User-Mode Application Authorization System For MacOS Written In Swift
Sinter is a 100% user-mode endpoint security agent for macOS 10.15 and above, written in Swift. Sinter uses the user-mode EndpointSecurity API to subscribe to and receive authorization callbacks from the macOS kernel, for a set of security-relevant event types. The current version of Sinter...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I'm giving a keynote address at the Cybersecurity and Data Privacy Law virtual conference on September 9, 2020. The list is maintained on this page...
Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2020-49577)
Symphony CMS is a PHP + MySQL based , using XML and XSLT as the backbone of the open source content management system . A cross-site scripting vulnerability exists in content/content.blueprintsevents.php in Symphony CMS 3.0.0. The vulnerability can be exploited by an attacker to conduct a...
CVE-2020-11993
creationtimestamp| type| source ---|---|--- 2020-08-07 20:55:20+00:00| seen| https://t.me/cibsecurity/13975 2020-08-25 07:24:53+00:00| seen| https://t.me/cKure/1973 2020-08-25 08:58:52+00:00| seen| https://t.me/thehackernews/816 2020-08-26 05:45:23+00:00| seen|...
Threat Source newsletter for July 30, 2020
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. Adversaries love to use headlines as part of their spam campaigns. From COVID-19, to Black Lives Matter and even Black Friday every year, the bad guys are wanting to capitalize on current events. Why is this the case, and when do...
CVE-2020-14510
creationtimestamp| type| source ---|---|--- 2020-07-29 13:18:51+00:00| seen| https://t.me/thehackernews/786 2020-07-29 21:40:39+00:00| seen| https://t.me/YemenShield/120 2020-07-31 07:51:27+00:00| seen| https://t.me/cKure/1568...