10732 matches found
CVE-2020-6521
Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...
PT-2020-14693 · D Link · Dir-816
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L devices versions 2.x before 1.10b04Beta02 Description: A security issue was found where an XSS problem exists due to a lack of output filtration applied to the RESULT parameter in the file webinc/js/info.php, which is then...
NewStart CGSL MAIN 6.01 : kernel Multiple Vulnerabilities (NS-SA-2020-0030)
The remote NewStart CGSL host, running version MAIN 6.01, has kernel packages installed that are affected by multiple vulnerabilities: - A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS...
openSUSE Security Update : ldb / samba (openSUSE-2020-1023)
"This update for ldb, samba fixes the following issues : Changes in samba : - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; bso14364 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
Cross site scripting
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
SMB12 Information Gathering Exploit
SMB12 Information Gathering is a data gathering python script that inspects SMB1 and SMB2 endpoints. It will extract various attributes from the remote server such as OS version only supported by SMB1 as per protocol definition, DNS computer name, DNS domain name, NetBIOS computer name and NetBIO...
Email Subscribers & Newsletters < 4.5.1 - Authenticated SQL injection in es_newsletters_settings_callback()
An authenticated high privilege attacker could exploit this issue an gain access to the DBMS. PoC https://github.com/tenable/poc/blob/master/WordPress/plugins/Icegram/emailsubscribersandnewsletters/sqliinfodisclosurepoc.py...
Mail.ru: Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru]
An IDOR vulnerability in dictor.mail.ru allowed to obtain arbitrary video information via direct GraphQL query...
CVE-2020-1462
An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge EdgeHTML-based, aka 'Skype for Business via Microsoft Edge EdgeHTML-based Information Disclosure Vulnerability'...
CVE-2020-1367
Technical details for CVE-2020-1367 are not publicly provided in the supplied documents; monitor for updates from official advisories and CVE databases.
Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5755)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5755 advisory. - p54usb: Fix race between disconnect and firmware loading Alan Stern Orabug: 31351863 CVE-2019-15220 - media: rc: prevent memory leak in cx23888irprob...
TrickBot Sample Accidentally Warns Victims They're Infected
TrickBot, the infamous info-stealing trojan, has been trying out a test module that accidentally pops up fraud alerts to victims. A sandboxed sample of the trojan, obtained by MalwareHunterTeam and analyzed by Advanced Intelligence’s Vitali Kremez, turns out to contain a new module, called “modul...
Unbreakable Enterprise kernel security update
kernel-uek 3.8.13-118.47.1 - media: ttusb-dec: Fix info-leak in ttusbdecsendcommand Tomas Bortoli Orabug: 31351121 CVE-2019-19533 - can: peakusb: fix slab info leak Johan Hovold Orabug: 31351143 CVE-2019-19534 - ALSA: core: Fix card races between register and disconnect Takashi Iwai Orabug:...
Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting
An Authenticated Stored Cross-Site Scripting XSS was discovered within the Company Info "Motto" field. When creating a new newsletter using an empty template with the header module, the XSS would execute. This was later fixed in version: 6.7.7 PoC...
Unbreakable Enterprise kernel security update
2.6.39-400.324.1 - media: ttusb-dec: Fix info-leak in ttusbdecsendcommand Tomas Bortoli Orabug: 31351122 CVE-2019-19533 - ALSA: core: Fix card races between register and disconnect Takashi Iwai Orabug: 31351895 CVE-2019-15214...
Visma Public: HTTP Request Smuggling at app.workbox.dk
The researcher was able to find a HTTP request CL.TE smuggling vulnerability at app.workbox.dk. The likely consequences would have result in interfering with normal user traffic, leak 'Session Cookies, leak PII info...
Scientific Linux Security Update : firefox on SL7.x x86_64 (20200707)
Security Fixes : - Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64 CVE-2020-12417 - Mozilla: Information disclosure due to manipulated URL object CVE-2020-12418 - Mozilla: Use-after-free in nsGlobalWindowInner CVE-2020-12419 - Mozilla: Use-After-Free when trying to...
ALPINE-CVE-2020-15564
An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOPregistervcpuinfo. The hypercall VCPUOPregistervcpuinfo is used by a guest to register a shared region with the hypervisor. The region will be mapped...