6434 matches found
Code injection
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node outside of the attacker's perimeter via an account with write permissions. This occurs because node IDs are predictable with incrementing numbers and the access control on...
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
Intelligence agencies in Australia, the U.K., and the U.S. issued a joint advisory on Wednesday detailing the most exploited vulnerabilities in 2020 and 2021, once again demonstrating how threat actors are able to swiftly weaponize publicly disclosed flaws to their advantage. "Cyber actors contin...
CISA Alert: Top Routinely Exploited Vulnerabilities
On July 28, 2021, the U.S. Cybersecurity and Infrastructure Security Agency CISA released a cybersecurity advisory detailing the top 30 publicly known vulnerabilities that have been routinely exploited by cyber threat actors in 2020 and 2021. Organizations are advised to prioritize and apply...
GO-2021-0110 Token reuse in github.com/ory/fosite
Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...
PT-2021-17897
Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform versions prior to 2020.2.5 HF1 Description: The node management page in SolarWinds Orion Platform allows an attacker to create or delete a node outside of the attacker's perimeter via an account with write permission...
CVE-2021-28674: Use of Insufficiently Random Values
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node outside of the attacker's perimeter via an account with write permissions. This occurs because node IDs are predictable with incrementing numbers and the access control on...
About the security content of macOS Big Sur 11.5
About the security content of macOS Big Sur 11.5 This document describes the security content of macOS Big Sur 11.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...
About the security content of iOS 14.7 and iPadOS 14.7
About the security content of iOS 14.7 and iPadOS 14.7 This document describes the security content of iOS 14.7 and iPadOS 14.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...
About the security content of Security Update 2021-004 Catalina
About the security content of Security Update 2021-004 Catalina This document describes the security content of Security Update 2021-004 Catalina. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...
About the security content of tvOS 14.7
About the security content of tvOS 14.7 This document describes the security content of tvOS 14.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of watchOS 7.6
About the security content of watchOS 7.6 This document describes the security content of watchOS 7.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Rancher Labs Rancher Access Control Error Vulnerability
Rancher Labs Rancher is an open source enterprise container management platform from Rancher Labs, Inc. An access control error vulnerability exists in Rancher Labs Rancher, which stems from the product's lack of effective privilege management for creating cloud credential IDs, which could be...
SQL Injection Vulnerability in iDS Networked Digital Signage Management System of Shenzhen Bright Diamond Technology Co.
iDS Networked Digital Signage Management System is a kind of digital signage management system that can be used for program management and terminal management. iDS Networked Digital Signage Management System of Shenzhen Bright Diamond Technology Co., Ltd. suffers from SQL injection vulnerability,...
Rancher Labs Rancher 安全漏洞
Rancher Labs Rancher is an open source enterprise container management platform from Rancher Labs, Inc. An access control error vulnerability exists in Rancher Labs Rancher, which stems from the product's lack of effective privilege management for creating cloud credential IDs, which could be...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-2079)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2021-2079)
According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an...
CVE-2011-0023
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
[ASA-202106-50] tor: denial of service
Arch Linux Security Advisory ASA-202106-50 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-34548 CVE-2021-34549 CVE-2021-34550 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2075 Summary ======= The...
Security Bulletin: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson TX1, Jetson TX2 Series (including Jetson TX2 NX), and Jetson Nano (including Jetson Nano 2GB) - June 2021
NVIDIA has released a software update for NVIDIA® Jetson AGX Xavier™ series, Jetson Xavier™ NX, Jetson™ TX1, Jetson TX2 series including Jetson TX2 NX, and Jetson Nano™ devices including Jetson Nano 2GB in the NVIDIA JetPack™ SDK. This update addresses security issues that may lead to escalation ...
Bumble: Exfiltrating a victim's exact location (to within 5m)
I used Bumble's distance feature to exfiltrate the exact location to within approx 5m of a victim. I did this by using the Bumble API to move my attacker account's location around the approximate area of the victim. I was able to obtain the exact distance between attacker and victim at 3 separate...