3680 matches found
UBUNTU-CVE-2020-1753
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...
Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...
MGASA-2020-0142 Updated thunderbird packages fix security vulnerabilities
The updated packages fix a security vulnerabilities: Out of bounds reads in sctploadaddressesfrominit. CVE-2019-20503 Use-after-free when removing data about origins. CVE-2020-6805 BodyStream::OnInputStreamReady was missing protections against state confusion. CVE-2020-6806 Use-after-free in cube...
CVE-2019-18576
Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...
CVE-2019-13205
All configuration parameters of certain Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 were accessible by unauthenticated users. This information was only presented in the menus when authenticated, and the pages that loaded this information were also protected. However, all files th...
Siemens SiNVR 3 Plain Text Save File Vulnerability
SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 stores login credentials in plain text in a log file. An information disclosure vulnerability exists in the implementation, which can be exploited by a...
CVE-2012-1094
JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...
CVE-2020-2149
Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...
CVE-2020-5327
Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI...
A Massive U.S. Property and Demographic Database Exposes 200 Million Records
More than 200 million records containing a wide range of property-related information on US residents were left exposed on a database that was accessible on the web without requiring any password or authentication. The exposed data — a mix of personal and demographic details — included the name,...
LaySNS suffers from SQL injection vulnerability in in***.php file
LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. LaySNS has a SQL injection vulnerability in the in.php file, which can be exploited by attackers to obtain sensitive database information...
jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page...
Estée Lauder Exposes 440M Records, with Email Addresses, Network Info
A non-password protected cloud database containing hundreds of millions of customer records and internal logs for cosmetic giant Estée Lauder has been found exposed online, according to researchers. In all, 440,336,852 individual data pieces were exposed, according to researcher Jeremiah Fowler a...
Israeli government’s Gov.il DNS server found vulnerable
By Sudais Asif Eitan Caspi, a security researcher has exposed certain vulnerabilities found in Israeli government websites. This is a post from HackRead.com Read the original post: Israeli government's Gov.il DNS server found vulnerable...
Jenkins < 2.219, < 2.204.2 LTS Multiple Vulnerabilities - Linux
Jenkins is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-7905
Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network...
