CVE-2020-5246

CVE-2020-5246 affects Traccar GPS Tracking System prior to version 4.9. The issue is an LDAP injection vulnerability triggered when user input is used in LDAP search filters, allowing an attacker to modify query logic and potentially obtain admin privileges in LDAP-configured deployments. The vul...

CVE-2020-5246 LDAP injection vulnerability in Traccar GPS Tracking System

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances wit...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:1886-1)

This update for xen fixes the following issues : CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. CVE-2020-15567: Fixed non-atomic modification of live EPT PTE bsc1173380. Note that Tenable...

Google Bans Stalkerware Ads – With a Loophole

Google will soon prohibit ads on its platform that promote stalkerware products and services – but the tech giant’s ban comes with a catch that some security experts worry will render it ineffective. Starting August 2020, Google’s ads policy will be updated to ban advertisements for stalkerware,...

SUSE-SU-2020:1889-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation...

SUSE-SU-2020:1886-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15567: Fixed non-atomic modification of live EPT PTE bsc1173380...

Hacking smart devices to convince dementia sufferers to overdose

Weve looked at numerous smart tracker watches over recent years. All had some disastrous security flaws. However, we found one recently that was a little different: it was aimed at the elderly, particularly those with dementia or other cognitive impairments. If the wearer goes for a walk and...

Potentially sensitive data exposure in Symfony Web Socket Bundle

Impact Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish, messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch does not succeed. The dispatch method can be considered to not succeed...

CVE-2020-15563

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

CVE-2020-15563

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

inverted code paths in x86 dirty VRAM tracking

ISSUE DESCRIPTION An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. IMPACT A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service DoS...

Atlassian JIRA Server and Data Center Cross-Site Request Forgery Vulnerability (CNVD-2021-17350)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

CVE-2019-9081

creationtimestamp| type| source ---|---|--- 2020-06-25 12:24:13+00:00| seen| MISP/e1d58ad8-7800-491b-a63b-a03d081914d4 2020-10-09 13:26:55+00:00| seen| MISP/b60ecd6e-648d-4bc4-a6ad-3527a2216be1 2023-03-09 09:29:35+00:00| seen| https://t.me/alexredsec/309 2025-03-30 17:32:48+00:00| seen|...

Apple Pushes Back Against Ad Tracking in Safari and iOS 14

At WWDC, the company detailed a litany of privacy-friendly improvements to its software...

Web skimming with Google Analytics

Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to...

Release Information for Veeam Backup for AWS v2

Requirements IMPORTANT You cannot update Veeam Backup for AWS operating in the Paid edition to version 2.0 from the Veeam Backup for AWS Web UI. To update the product, you must install Veeam Backup for AWS version 2.0 from AWS Marketplace on a new EC2 instance, and then migrate Veeam Backup for A...

DroidTracker - Script To Generate An Android App To Track Location In Real Time

Script to generate an Android App to track location in real time Features: Custom App Name 2 Port Forwarding options Ngrok or using SSH Tunneling with Serveo.net Obfuscated URL by Tinyurl Fully Undetectable Legal disclaimer: Usage of DroidTracker for attacking targets without prior mutual consent...

Formphish - Auto Phishing Form-Based Websites

Auto Phishing form-based websites. This tool can automatically detect inputs on html form-based websites to create a phishing page. Features: Auto detect device Port Forwarding by Ngrok IP Tracker Legal disclaimer: Usage of Formphish for attacking targets without prior mutual consent is illegal...

Facial recognition: tech giants take a step back

Last week, a few major tech companies informed the public that they will not provide facial recognition software to law enforcement. These companies are concerned about the way in which their technology might be used. What happens when software that threatens our privacy falls into the hands of...