9955 matches found
CVE-2020-15647
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This vulnerability affects Firefox for Android...
PT-2020-14569
Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to the fixed version Description A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies...
CVE-2020-15647: Exposure of Sensitive Information to an Unauthorized Actor
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This vulnerability affects Firefox for Android...
Black Hat 2020: Linux Spyware Stack Ties Together 5 Chinese APTs
A stack of Linux backdoor malware used for espionage, compiled dynamically and customizable to specific targets, is being used as a shared resource by five different Chinese-language APT groups, according to researchers. According to an analysis from BlackBerry released at Black Hat 2020 on...
PT-2020-3571
Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to a Server-Side Request Forgery SSRF flaw. It allows an attacker, with access to add an Ansible Tower provider, to scan and attack systems from the internal network th...
jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
keycloak: missing input validation in IDP authorization URLs
A flaw was found in Keycloak, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients...
“Secondary index is corrupt" error in ConnectWise Manage plugin after upgrading to Windows 10 version 2004
Challenge After upgrading the machine where Veeam Service Provider Console is installed to Windows 10 version 2004, ConnectWise Manage plugin stops working with the following error: "Secondary index is corrupt. The database must be defragmented or the affected index must be deleted. If the corrup...
Lazarus Group Surfaces with Advanced Malware Framework
The North Korea-linked APT known as Lazarus Group has debuted an advanced, multipurpose malware framework, called MATA, to target Windows, Linux and macOS operating systems. Kaspersky researchers uncovered a series of attacks utilizing MATA so-called because the malware authors themselves call...
Security Vulnerabilities fixed in Firefox for Android 68.10.1 — Mozilla
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins...
CVE-2020-2021
When Security Assertion Markup Language SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled unchecked, improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources...
CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication
When Security Assertion Markup Language SAML authentication is enabled and the ‘Validate Identity Provider Certificate’ option is disabled unchecked, improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources...
Satori Botnet Creator Sentenced to 13 Months in Prison
A 22-year-old man has been sentenced to more than a year in prison for developing Mirai botnet variants that compromised hundreds of thousands of devices worldwide. The man, Kenneth Currin Schuchman, of Vancouver, Wash., was sentenced to 13 months in prison after pleading guilty to creating and...