CVE-2020-26102: Undefined Security Weakness

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM SEC-550...

CVE-2020-26106: Incorrect Permission Assignment for Critical Resource

cPanel before 88.0.3 has weak permissions world readable for the proxy subdomains log file SEC-558...

CVE-2020-26115: Improper Neutralization of Input During Web Page Generation

cPanel before 90.0.10 allows self XSS via the Cron Editor interface SEC-574...

CVE-2020-26111: Improper Neutralization of Input During Web Page Generation

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

CVE-2020-26108: Undefined Security Weakness

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution SEC-488...

CVE-2020-3611

u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8098, Kamorta, MSM8998, QCS404, QCS605, SDA66...

CVE-2020-3611

CVE-2020-3611 affects Qualcomm/Qualcomm-based Snapdragon platforms (e.g., APQ8098, Kamorta, MSM8998, QCS404/605, SDA660/845, SDM6xx/7xx, SXR1130, etc.). The root cause is an improper access issue caused by XBL SEC clearing only the ZI region when loading Qualcomm-signed segments, which can lead t...

CVE-2020-3611

u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8098, Kamorta, MSM8998, QCS404, QCS605, SDA66...

Malicious Package in sj-tw-sec

All versions of sj-tw-sec contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Eikon Thomson Reuters 4.0.42144 File Permissions

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Extensive file permissions on service executable product: Eikon Thomson Reuters vulnerable version: 4.0.42144 fixed version: - CVE number: CVE-2019-10679 impact: High...

Twitter Could Face $250M FTC Fine Over Improper Data Use

Twitter may be facing a Federal Trade Commission FTC fine of up to $250 million, after the social media giant last year revealed the improper use of users’ email addresses and phone numbers. In October 2019, Twitter acknowledged that user phone numbers and email addresses gathered for security...

WonderCMS 3.1.0 XSS / Directory Traversal / File Upload Vulnerabilities

Exploit for php platform in category web applications title: Multiple Vulnerabilities product: WonderCMS vulnerable version: =3.1.0 fixed version: - CVE number: - impact: High homepage: https://www.wondercms.com/ found: 2020-04-30 by: Calvin Phang Office Singapore SEC Consult Vulnerability Lab An...

KLA12077 DoS vulnerability in Wireshark

A denial of service vulnerability was found in Wireshark. Malicious users can exploit this vulnerability to cause denial of service. Original advisories wnpa-sec-2020-09 · GVCP dissector infinite loop Related products Wireshark CVE list CVE-2020-15466 critical Solution Update to the latest versio...

CVE-2020-7663

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

CVE-2020-7662

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

Design/Logic Flaw

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

UBUNTU-CVE-2020-7663

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

CVE-2020-7663

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

CVE-2020-7662

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

CVE-2020-7663

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...