Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

Awesome Web Security 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of...

CVE-2020-2278

Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content...

librepo: missing path validation in repomd.xml may lead to directory traversal

A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This fl...

CVE-2020-25278

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225,...

CVE-2020-25278

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225,...

Code injection

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225,...

CVE-2020-25278

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225,...

CVE-2020-25278

Summary of CVE-2020-25278 (Samsung) : The vulnerability affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). The issue stems from the Quram image codec library, which can be exploited by crafted JPEG data to overwrite memory and execute arbitrary code during decoding. Impact is des...

CVE-2020-15802

A flaw was found in the bluetooth specification that would allow an attacker within bluetooth radio range to abuse a protocol flaw which could allow key-overwrite in services. Mitigation As the bluetooth module will be auto-loaded when required, its use can be disabled by preventing the module fr...

The vulnerability of Cisco Enterprise NFV Infrastructure Software (NFVIS) relates to incorrect path name restrictions for access-limited directories, allowing a perpetrator to re-record arbitrary files in the operating system of the vulnerable device.

The vulnerability of Cisco Enterprise NFV Infrastructure Software NFVIS is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to re-record any files in the operating system of the vulnerable device remotely...

New Unpatched Bluetooth Flaw Lets Hackers Easily Target Nearby Devices

Bluetooth SIG—an organization that oversees the development of Bluetooth standards—today issued a statement informing users and vendors of a newly reported unpatched vulnerability that potentially affects hundreds of millions of devices worldwide. Discovered independently by two separate teams of...

Microsoft OneDrive for Windows Elevation of Privilege Vulnerability (CNVD-2020-54061)

OneDrive is a file hosting service and synchronization service introduced by Microsoft as part of the Web version of Office. An elevation of privilege vulnerability exists in OneDrive for Windows. The vulnerability stems from the OneDrive for Windows desktop application not properly handling...

Microsoft OneDrive for Windows Elevation of Privilege Vulnerability (CNVD-2020-54060)

OneDrive is a file hosting service and synchronization service introduced by Microsoft as part of the Web version of Office. An elevation of privilege vulnerability exists in OneDrive for Windows. The vulnerability stems from the OneDrive for Windows desktop application not properly handling...

Microsoft OneDrive for Windows Elevation of Privilege Vulnerability (CNVD-2020-54062)

OneDrive is a file hosting service and synchronization service introduced by Microsoft as part of the Web version of Office. An elevation of privilege vulnerability exists in OneDrive for Windows. The vulnerability stems from the OneDrive for Windows desktop application not properly handling...

Microsoft OneDrive Multiple Vulnerabilities (Sep 2020)

This host is missing an important security update according to Microsoft Security Updates for month of September SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-11117

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018,...

OneDrive for Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file with an elevated status. To exploit this vulnerability, an attacker would...

PT-2020-4024 · Microsoft · Onedrive For Windows

Name of the Vulnerable Software and Affected Versions: OneDrive for Windows affected versions not specified Description: The issue is related to the improper handling of symbolic links by the OneDrive for Windows Desktop application. This could allow an attacker to overwrite a targeted file with ...

PT-2020-4019 · Microsoft · Onedrive For Windows Desktop

Name of the Vulnerable Software and Affected Versions: OneDrive for Windows Desktop affected versions not specified Description: The issue arises from the improper handling of symbolic links by the OneDrive for Windows Desktop application, leading to a potential elevation of privilege. An attacke...

CVE-2019-20916

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an...