kernel: information exposure in drivers/char/random.c and kernel/time/timer.c

A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality...

CVE-2020-7740

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack...

Input validation

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack...

CVE-2020-7740

CVE-2020-7740 affects node-pdf-generator (all versions up to 0.0.6 per GHSA entry). The root cause is lack of user input validation and sanitization for content fed to the module, enabling an attacker to craft a URL that is passed to an external server, resulting in Server-Side Request Forgery (S...

CVE-2020-26518

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

CVE-2020-26518

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

Debian DLA-2385-1 : linux-4.19 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak. CVE-2019-3874 Kernel buffers allocated by the SCTP network protocol were not limited by the memory cgroup controller. A local user could potentially us...

Information Disclosure

OpenSSL is vulnerable to information disclosure. A rewritten random number generator RNG that was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state and was not being used in the default case...

Matt Blaze on OTP Radio Stations

Matt Blaze discusses also here an interesting mystery about a Cuban one-time-pad radio station, and a random number generator error that probably helped arrest a pair of Russian spies in the US...

OSV-2020-1787 Use-of-uninitialized-value in zend_generator_search_multi_children_node

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25678 Crash type: Use-of-uninitialized-value Crash state: zendgeneratorsearchmultichildrennode zendgeneratoraddchild zendgeneratoryieldfrom...

How to choose reputable QR Code generator with logo for business?

By ghostadmin Why do online businesses prefer working with reputable QR code generators with the logo? This is a post from HackRead.com Read the original post: How to choose reputable QR Code generator with logo for business?...

HTTP-revshell - Powershell Reverse Shell Using HTTP/S Protocol With AMSI Bypass And Proxy Aware

HTTP-revshell is a tool focused on redteam exercises and pentesters. This tool provides a reverse connection through the http/s protocol. It use a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS and AV. Help server.py unisessio...

Server-Side Request Forgery (SSRF)

Overview node-pdf-generator is a Web server to generate PDF's from HTML Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to...

Insecure Default Configuration in graphql-code-generator

Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to version 0.18.2 ...

GHSA-9W87-4J72-GCV7 Insecure Default Configuration in graphql-code-generator

Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to version 0.18.2 ...

Hack-Tools - The All-In-One Red Team Extension For Web Pentester

The all-in-oneRed Team browser extension for Web Pentesters HackTools, is a web extension facilitating your web application penetration tests , it includes cheat sheets as well as all the tools used during a test such as XSS payloads, Reverse shells and much more. With the extension you no longer...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

CVE-2020-20633

CVE-2020-20633 affects the WordPress plugin GDPR Cookie Consent (cookie-law-info) versions 1.8.2 and earlier, via ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php. The vulnerability allows authenticated stored XSS and privilege escalation. The co...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

Linux kernel information disclosure vulnerability (CNVD-2020-44611)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in Linux kernel 5.7.11 and earlier versions. A remote attacker could exploit the vulnerability to obtain sensitive information about th...