The vulnerability of the do_core_note function in the File type detection utility allows a attacker to cause a service failure.

The vulnerability of the docorenote function in the File type detection utility relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the do_core_note function in the File type detection utility allows a attacker to cause a service failure.

The vulnerability of the docorenote function in the File type detection utility is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the makernote-offset relationship to valuelen...

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the datalen variable...

Apache Tika Memory Overflow Vulnerability (CNVD-2020-33326)

Apache Tika is the United States Apache Apache Software Foundation, an integrated POI using Java programs to provide MicrosoftOffice format documents read and write functions of the open-source library, Pdfbox read and create PDF documents pure Java class library and for text extraction work to...

Threat Spotlight: MedusaLocker

By Edmund Brumaghin, with contributions from Amit Raut. Overview MedusaLocker is a ransomware family that has been observed being deployed since its discovery in 2019. Since its introduction to the threat landscape, there have been several variants observed. However, most of the functionality...

CVE-2020-11826

The CVE-2020-11826 entry affects Memono version 3.8, where notes locked with a password are stored in plaintext in the memono.sqlite database. Specifically, notes reside in the ZENTITY table and can be read without knowing the password, indicating a data exposure due to lack of encryption. The co...

holz-becker.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142773 Security Researcher Hchabik Helped patch 2358 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting holz-becker.com website and...

CVE-2018-21073

An issue was discovered on Samsung mobile devices with N7.x and O8.0 Galaxy S9+, Galaxy S9, Galaxy S8+, Galaxy S8, Note 8. There is access to Clipboard content in the locked state via the Edge panel. The Samsung ID is SVE-2017-10748 May 2018...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-32823)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A security vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to successfully boot a Samsung Galaxy Note8 device with root...

tweaksguide.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8505 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting tweaksguide.com website and its users. Following coordinat...

Threat Analysis Unit (TAU) Threat Intelligence Notification: CoronaVirus Ransomware

"CoronaVirus" Ransomware has been found distributed via a phishing website. The malicious website will distribute a trojan downloader which then leads to downloading additional malicious payloads: the Kpot InfoStealer and Coronavirus Ransomware. "CoronaVirus" Ransomware will perform the deletion ...

Design/Logic Flaw

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature...

CVE-2020-10956

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature...

PT-2020-12447 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.10 through 12.9 Description: The issue is related to a Server-Side Request Forgery SSRF in the project import note feature. This allows an attacker to forge requests from the server, potentially leading to unauthorized acces...

CVE-2020-10956: Server-Side Request Forgery (SSRF)

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature...

AZL-6791 CVE-2019-20633 affecting package patch 2.7.6-8

GNU patch through 2.7.6 contains a freeplinepend Double Free vulnerability in the function anotherhunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952...

CVE-2020-10847

An issue was discovered on Samsung mobile devices with P9.0 Galaxy S8 and Note8 software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-16614 February 2020...

Microsoft RCE Vulnerabilities Affecting Windows, Windows Server

Microsoft has released a security advisory to address remote code execution vulnerabilities in Adobe Type Manager Library affecting all currently supported versions of Windows and Windows Server operating systems. A remote attacker can exploit these vulnerabilities to take control of an affected...

GitLab: SSRF on project import via the remote_attachment_url on a Note

Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...