Mozilla permanently shuts down Notes & Send over malicious use

By Waqas Reportedly, people were using these services for malicious purposes especially launching phishing and malware attacks. This is a post from HackRead.com Read the original post: Mozilla permanently shuts down Notes & Send over malicious use...

Information Disclosure

derhansen/sfeventmgt is vulnerable to information disclosure. Missing access checks in the backend module allows an authenticated user to export restricted participant data for events or send emails to event participants for events which the user does not have access to...

GHSA-G8RG-7RPR-CWR2 Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...

Security fix for the ALT Linux 8 package sudo version 1:1.9.2-alt1

Aug. 30, 2020 Evgeny Sinelnikov 1:1.9.2-alt1 - Update to latest release of the sudo 1.9 Fixes: CVE-2019-19232, CVE-2019-19234 - Added sudo event and I/O log server - Added send sudo I/O log to log server utility - Added selinux support - Added native audit support...

Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

RUSTSEC-2020-0034 Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

PT-2020-17518

Name of the Vulnerable Software and Affected Versions arr crate versions through 2020-08-25 Description The issue allows an attacker to smuggle non-Sync/Send types across a thread boundary, causing a data race. Specifically, the arr crate incorrectly implements Sync/Send bounds. Additionally, the...

PT-2020-17520

Name of the Vulnerable Software and Affected Versions arr crate through 2020-08-25 Description The issue concerns the arr crate, which contains multiple security issues. These include incorrect implementation of Sync/Send bounds, allowing non-Sync/Send types to be smuggled across thread boundarie...

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...

PT-2020-21871

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Global-buffer-overflow READ 1. The crash state involves functions such as vte write debug, send primary...

PT-2020-6210

Name of the Vulnerable Software and Affected Versions QEMU libslirp versions prior to 4.3.1 Description An out-of-bounds read issue was found in the SLiRP networking implementation of the QEMU emulator. This occurs in the icmp6 send echoreply routine while replying to an ICMP echo request, also...

Shopify: STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend

I discovered a bug in an android mobile app that allowed STAFF No Permissions using Receipt Send to Mobile of any Order information in the Store. Steps to reproduce: 1 STAFF account is created and assigned "No Permissions" on a Shop by Owner/Admin 2 STAFF then login to shop. Notice that STAFF is...

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

Verint Workforce Optimization (WFO) Injection Vulnerability

Verint Workforce Optimization is a unified suite of software and services for capturing interactions and managing employee performance across an enterprise or target area. A security vulnerability exists in Verint Workforce Optimization WFO version 15.2. An attacker could exploit the vulnerabilit...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

Design/Logic Flaw

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

CVE-2020-13480

The connected records confirm CVE-2020-13480 affects Verint Workforce Optimization (WFO) version 15.2 and is caused by HTML injection via the Send Email feature. The vulnerability details indicate an injection in a functional path that could affect email composition/handling within WFO. No exploi...

PT-2020-13564

Name of the Vulnerable Software and Affected Versions Verint Workforce Optimization WFO version 15.2 Description The issue allows HTML injection via the "send email" feature. This could potentially lead to malicious activities such as phishing or cross-site scripting XSS attacks, where an attacke...