Cross site request forgery (csrf)

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

CVE-2020-24353

CVE-2020-24353 affects Pegasystem Pega Platform prior to 8.4.0. The issue is a cross-site scripting (XSS) vulnerability triggered by stream rule parameters used in the request header. Public descriptions consistently cite an XSS risk impacting versions before 8.4.0; the underlying cause is an imp...

CVE-2020-24353

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

PT-2020-15701

Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.4.0 Description The issue is related to a XSS problem via stream rule parameters used in the request header. Recommendations For versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue. ...

CVE-2020-24353: Improper Neutralization of Input During Web Page Generation

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

CVE-2020-5941

On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel TMM to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a hostname passes to the RESOLV::lookup command...

spamassassin: command injection via crafted configuration file

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration .cf files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2020-2441)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : unbound (EulerOS-SA-2020-2423)

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP...

Design/Logic Flaw

u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

CVE-2020-3696

u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

CVE-2020-3696

CVE-2020-3696 describes a use-after-free in the IP cracker (ipcrtr) when installing a new security rule since the old one is deleted but could still be in use. Affected families include Snapdragon Auto/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables and Snapdragon Wired Infrastructure ...

CVE-2020-3696: Use After Free

u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

CVE-2020-3578 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Portal Access Rule Bypass Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked...

CVE-2020-3578 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Portal Access Rule Bypass Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked...

PT-2020-4701

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance ASA Software versions prior to the fixed release Cisco Firepower Threat Defense FTD Software versions prior to the fixed release Description The issue is related to insufficient validation of URLs when portal...

Threat Source newsletter (Oct. 15, 2020)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. In our latest entry into our election security series, we’re turning our attention to the professionals who are responsible for securing our elections. After months of research, we’ve compiled a series of recommendations for local,...

CVE-2020-0246

In getCarrierPrivilegeStatus of UiccAccessRule.java, there is a missing permission check. This could lead to local information disclosure of EID data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

There Goes The Neighborhood: Dealing With CVE-2020-16898 (and CVE-2020-1656) (aka"Bad Neighbor")

If you’re in the U.S. and were waiting for an “October surprise”, look no further than CVE-2020-16898 which is a remote code execution RCE vulnerability in the Windows TCP/IP stack, or what our own Tod Beardsley likes to call “exploiting poor implementations of core IETF RFCs”. The vulnerability...

arabruleoflaw.org Cross Site Scripting vulnerability OBB-1405196

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...