470 matches found
PT-2021-6568
Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.24.0 Description The issue is related to a buffer over-read in the mbedtls x509 crl parse der function, which can lead to a denial of service. This can be exploited by a remote attacker. The function is part of...
00ld8nuivn (=2.1.0), 00rqiw31nd (=2.1.0) +4460 more potentially affected by unknown CVE via base64url (>=0.0.3 <=2.0.0)
base64url NPM version =0.0.3, =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on base64url and may be impacted: - 00ld8nuivn =2.1.0 - 00rqiw31nd =2.1.0 - 01dk01majk =2.1.0 - 02rjq8i863 =1.1.0 - 02vx8qsp01 =2.1.0 - 05y6tjgmws =1.1.0 - 066m7q8o0z...
@decentverse/server (>=0.0.1 <=0.0.148), @swapscanner/truffle-hdwallet-provider-klaytn (=1.4.2) +18 more potentially affected by CVE-2020-7717 via dot-notes (=3.1.1)
dot-notes NPM version =3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dot-notes and may be impacted: - @decentverse/server =0.0.1, =1.0.0, =1.0.0, =1.0.1, =1.4.0, =1.0.0, =1.6.4, =0.0.1, =1.0.0, =0.0.1, =0.1.1 and more Source cves: CVE-2020-7717...
Websites Conducting Port Scans
Security researcher Charlie Belmer is reporting that commercial websites such as eBay are conducting port scans of their visitors. Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites. I...
UBUNTU-CVE-2020-13230
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account e.g., permission to view logs...
Win2016LPE
Win2016LPE Windows10 & Windows Server 2016 LPE Exploit 利用 schedsvc!SchRpcSetSecurity 漏洞 目录说明 bin-x86 为支持Win10 x86系统的Bin bin-x64 为支持Win10 x64 、 Win2016系统的Bin Win2016LPE 为提权主程序 ALPC-TaskSched-LPE 漏洞利用DLL ExpDLL exploit dll 编译生成之后放置于ALPC-TaskSched-LPE\resource目录 更新历史 2018-09-28...
CVE-2020-10540
Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules...
Google Advises Android Developers to Encrypt App Data On Device
Google today published a blog post recommending mobile app developers to encrypt data that their apps generate on the users' devices, especially when they use unprotected external storage that's prone to hijacking. Moreover, considering that there are not many reference frameworks available for t...
CVE-2019-13163
The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...
Fedora: Security Advisory for xmlsec1 (FEDORA-2020-9573355ff4)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2019-8698
A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in iOS 12.4, tvOS 12.4. A malicious application may be able to restrict access to websites...
CVE-2019-8565
A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges...
UBUNTU-CVE-2016-1000107
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an...
Mozilla Network Security Services Resource Management Error Vulnerability
Mozilla Network Security Services NSS is a library of functions Network Security Services library from the Mozilla Foundation in the United States. The product provides cross-platform support for SSL, S/MIME and other Internet security standards. A resource management error vulnerability exists i...
JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...
USN-4139-1 file-roller vulnerability
It was discovered that File Roller incorrectly handled certain TAR files. An attacker could possibly use this issue to overwrite sensitive files during extraction...
wolfSSL buffer overflow vulnerability (CNVD-2019-34376)
wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in the 'CheckCertSignatureex' function in the wolfcrypt/src/asn.c file in wolfSSL 4.1.0 and earli...
CVE-2019-3739
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys...
The vulnerability of the OpenSSL library, related to errors in the certificate validation process, allows attackers to compromise the integrity of data.
The vulnerability of the OpenSSL library is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...