UBUNTU-CVE-2020-29372

An issue was discovered in domadvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORINGOPMADVISE implementation, aka CID-bc0c4d1e176e...

Major BEC Phishing Ring Cracked Open with 3 Arrests

Three men suspected of participating in a massive business email compromise BEC ring have been arrested in Lagos, Nigeria. A joint INTERPOL, Group-IB and Nigeria Police Force cybercrime investigation resulted in the arrest of the Nigerian nationals, believed to be responsible for distributing...

Database leak exposed mass credential stuffing against Spotify users

By Deeba Ahmed Researchers helped Spotify detect and address a severe credential stuffing operation affecting hundreds of millions of its users. This is a post from HackRead.com Read the original post: Database leak exposed mass credential stuffing against Spotify users...

DEBIAN-CVE-2020-28974

A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KDFONTOPCOPY in drivers/tty/vt/vt.c can be used for manipulations such as font height...

UBUNTU-CVE-2020-28974

A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KDFONTOPCOPY in drivers/tty/vt/vt.c can be used for manipulations such as font height...

CVE-2020-4788

A flaw was found in the Linux kernel. IBM Power9 processors can speculatively operate on data stored in the L1 cache before it has been completely validated. The attack has limited access to memory and is only able to access memory normally permissible to the execution context. The highest threat...

Schneider Electric EcoStruxure Building Operation WebReports Arbitrary File Upload Vulnerability

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An arbitrary file upload vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9-3.1. The vulnerability stems from improper validation of...

Linux kernel 缓冲区错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A slab out-of-bounds read vulnerability exists in fbcon in Linux kernel versions prior to 5.9.7. The vulnerability...

Schneider Electric EcoStruxure Building Operation WebReports Improper Access Control Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An improper access control vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. A remote attacker could exploit this vulnerability to access restricted web resources...

Schneider Electric EcoStruxure Building Operation WebReports XML External Entity References Improperly Restricted Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An improperly restricted XML external entity reference vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from a misconfiguration of the XML...

Schneider Electric EcoStruxure Building Operation WebStation Cross-Site Scripting Vulnerability

The EcoStruxure Building Operation WebStation is a web-based user interface for daily operations in the EcoStruxure BMS. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebStation 2.0 - 3.1. An attacker can exploit this vulnerability to inject HTML and JavaScript cod...

GaussDB Kernel: Checking the Administrator Whose ID Is 10

The system administrator with the ID 10 has the highest database permissions, that is, has all system and object permissions. It is recommended that this user be used only for DBA management instead of service applications. Carefully check the operation records of this system administrator...

CVE-2020-7570

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting Stored vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect...

CVE-2020-7573

A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control...

CVE-2020-7569

A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code...

CVE-2020-7570

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting Stored vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect...

CVE-2020-7573

A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control...

CVE-2020-7569

A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code...

CVE-2020-7572

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...

CVE-2020-28209

A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agen...