Arbitrary Code Execution

Overview jingo is a git based wiki engine written for node.js, with a decent design, a search capability and a good typography. Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function yaml.load of the package js-yaml instead of its...

X (Formerly Twitter): Safe Redirect Bypass

Hello Team, Summary: The url below bypasses the safe redirect and redirects directly to the malicious website. http://evil.org/%00 The reason for this may be the fix in the report 921286. Steps: Tweet the url below: http://evil.org/%00 Thanks! @cyanpiny Impact The attacker can direct the victim...

Why Application Security Should Be Considered An Enabler For Business

If you ask Alex, he won't admit being old-fashioned. He has been working in the IT industry for a while now and accepts that security is important for the business's health. But reluctant to take security as the business enabler. In today's environment, moving to digitization is a critical step...

‘Safe Documents’ tool in Office 365 will automatically detect malware

By Waqas Currently, "Safe Documents" is available for a ... This is a post from HackRead.com Read the original post: 'Safe Documents' tool in Office 365 will automatically detect malware...

Unspecified Vulnerability in F-Secure SAFE

F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure. A security vulnerability in F-Secure SAFE version 17.7 macOS exists because the program fails to properly validate the client version, which can be exploited by an attacker to execute commands on a system with the...

Unspecified Vulnerability in F-Secure SAFE (CNVD-2021-25666)

F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure. A security vulnerability exists in F-Secure SAFE version 17.7 macOS, which stems from the XPC service's use of a PID to identify the connecting client, and can be exploited by an attacker to execute commands on the...

CVE-2020-14977

An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execut...

CVE-2020-14978

An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine...

Code injection

An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine...

Code injection

An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execut...

CVE-2020-14977

The CVE affects F-Secure SAFE 17.7 on macOS. The vulnerability arises because XPC services identify connecting clients by PID, enabling a PID reuse attack that lets an attacker connect to a privileged XPC service and execute privileged commands, provided the attacker already compromised the machi...

CVE-2020-14978

An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine...

CVE-2020-14978

CVE-2020-14978 affects F-Secure SAFE 17.7 on macOS. The root cause is incorrect client version verification, enabling an attacker who already has code execution on a machine to connect to a privileged XPC service and execute privileged commands. The attack requires prior compromise and grants hig...

Kids on the Web in 2020

Technology is what is saving us from a complete change in the way of life in a world of a raging pandemic. It keeps the educational process going, relieves the shortage of human communication and helps us to live life as fully as possible given the isolation and social distancing. Many adults, an...

PYSEC-2020-341

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

COVIDSafe app information disclosure vulnerability

COVIDSafe app is an Australian coronavirus contact tracing app. An information disclosure vulnerability exists in the COVIDSafe app. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker could exploit the vulnerability to obtain...

CVE-2020-12856

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used...

Black Hat USA, DEF CON 28 Go Virtual

Cybersecurity conferences Black Hat USA and DEF CON 28 will not be held in person this year due to the coronavirus pandemic. The conferences will both instead be transformed into completely virtualized events. Both back-to-back annual conferences were set to take place in Las Vegas this year; Bla...

Xxe

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...