CVE-2020-7323

McAfee Endpoint Security (ENS) for Windows is affected up to version 10.7.0. The issue is an Authentication Protection Bypass where a local, physically present attacker can bypass the Windows lock screen by triggering certain ENS detection events while McTray.exe is running with elevated privileg...

IBM Security Key Lifecycle Manager Code Issue Vulnerability

IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A code issue vulnerability exists in IBM Security Key...

qemu: weak signature generation in Pointer Authentication support for ARM

A flaw was found in QEMU in the implementation of the Pointer Authentication PAuth support for ARM. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer an...

Security Bulletin: Vulnerabilities in Netty affect IBM Netcool Agile Service Manager (CVE-2020-7238)

Summary Vulnerabilities in Netty used by IBM Netcool Agile Service Manager have been identified. Netcool Agile Service Manager has addressed the CVE. Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling...

Unspecified Vulnerability in Sylabs Singularity (CNVD-2020-52438)

Singularity is a Linux-based container platform for running standalone applications. A security vulnerability exists in Sylabs Singularity versions 3.0 through 3.5. An attacker can exploit the vulnerability to bypass ECL protection...

U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

CVE-2020-15580

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can bypass Factory Reset Protection FRP by enrolling a new lock password. The Samsung ID is SVE-2020-17328 July 2020...

RHEL 7 : OpenShift Container Platform 4.4.z jenkins-2-plugins (RHSA-2020:2737)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2737 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Remote Code Execution (RCE)

jenkins-script-security-plugin is vulnerable to remote code execution. It is possible because of sandbox protection bypass...

RHEL 7 : OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2020:2478)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2478 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Design/Logic Flaw

An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username under which the web server is running by triggering an invalid path permission error. This bypasses the fakepath protection mechanism...

Dolibarr ERP/CRM DMS/ECM Module Cross-Site Scripting Vulnerability (CNVD-2020-41507)

Dolibarr ERP/CRM is a Web-based Enterprise Resource Planning ERP and Customer Relationship Management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, etc. DMS/ECM is one of the document management systems and enterprise...

PT-2020-13390 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue allows users with the 'Setup documents directories' permission to rename uploaded files, giving them insecure file extensions. This bypasses the .noexe protection mechanism, potentially leading t...

Teclib GLPI Input Validation Error Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An input validation error vulnerability exists in Teclib GLPI versions prior...

libreoffice: Insufficient URL encoding flaw in allowed script location check

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation

Title: Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation Date: 2020-04-21 Author: Marco Ivaldi Vendor: www.oracle.com CVE: CVE-2020-2944 / raptorsdtcmconv.c - CDE sdtcmconvert LPE for Solaris/Intel Copyright c 2019-2020 Marco Ivaldi A buffer overflow in the SanityCheck...

McAfee Endpoint Security Privilege Permission and Access Control Issues Vulnerability (CNVD-2020-24145)

McAfee Endpoint Security ENS is the United States McAfee McAfee company's set of framework for providing intelligent collaboration and advanced threat defense. The framework supports the entire threat defense lifecycle of real-time communications control and actionable threat forensics and so on...

CVE-2017-18676

CVE-2017-18676 affects Samsung mobile devices running Android N (7.0) on Qualcomm chipsets and is described as an RKP kernel protection bypass caused by a lack of MSR trapping, enabling potential unwanted memory mappings. The issue is tied to Samsung ID SVE-2016-7901 (April 2017). Connected docum...

CVE-2016-11036

An issue was discovered on Samsung mobile devices with M6.0 software. There is a Factory Reset Protection FRP bypass. The Samsung ID is SVE-2016-6008 August 2016...

CVE-2018-12886

stackprotectprologue in cfgexpand.c and stackprotectepilogue in function.c in GNU Compiler Collection GCC 4.1 through 8 under certain circumstances generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the...