The vulnerability of the cryptobiblioteca xmlsec, related to an incorrect limitation on XML links to external objects, allows a violator to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the xmlsec cryptobibliothek is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and accessibility of the protected information...

nss: Use-after-free in sftk_FreeSession due to improper refcounting

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

UBUNTU-CVE-2020-28852

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. x/text/language is supposed to be able to parse an HTTP Accept-Language header...

CVE-2020-5664

Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors...

USN-4613-1 python-cryptography vulnerability

Hubert Kario discovered that python-cryptography incorrectly handled certain decryption. An attacker could possibly use this issue to expose sensitive information...

PT-2021-6568

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.24.0 Description The issue is related to a buffer over-read in the mbedtls x509 crl parse der function, which can lead to a denial of service. This can be exploited by a remote attacker. The function is part of...

Websites Conducting Port Scans

Security researcher Charlie Belmer is reporting that commercial websites such as eBay are conducting port scans of their visitors. Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites. I...

UBUNTU-CVE-2020-13230

In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account e.g., permission to view logs...

Win2016LPE

Win2016LPE Windows10 & Windows Server 2016 LPE Exploit 利用 schedsvc!SchRpcSetSecurity 漏洞 目录说明 bin-x86 为支持Win10 x86系统的Bin bin-x64 为支持Win10 x64 、 Win2016系统的Bin Win2016LPE 为提权主程序 ALPC-TaskSched-LPE 漏洞利用DLL ExpDLL exploit dll 编译生成之后放置于ALPC-TaskSched-LPE\resource目录 更新历史 2018-09-28...

CVE-2020-10540

Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules...

Google Advises Android Developers to Encrypt App Data On Device

Google today published a blog post recommending mobile app developers to encrypt data that their apps generate on the users' devices, especially when they use unprotected external storage that's prone to hijacking. Moreover, considering that there are not many reference frameworks available for t...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Fedora: Security Advisory for xmlsec1 (FEDORA-2020-9573355ff4)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-8698

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in iOS 12.4, tvOS 12.4. A malicious application may be able to restrict access to websites...

CVE-2019-8565

A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges...

UBUNTU-CVE-2016-1000107

inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an...

Mozilla Network Security Services Resource Management Error Vulnerability

Mozilla Network Security Services NSS is a library of functions Network Security Services library from the Mozilla Foundation in the United States. The product provides cross-platform support for SSL, S/MIME and other Internet security standards. A resource management error vulnerability exists i...

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...

USN-4139-1 file-roller vulnerability

It was discovered that File Roller incorrectly handled certain TAR files. An attacker could possibly use this issue to overwrite sensitive files during extraction...

wolfSSL buffer overflow vulnerability (CNVD-2019-34376)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in the 'CheckCertSignatureex' function in the wolfcrypt/src/asn.c file in wolfSSL 4.1.0 and earli...