Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this...

Information disclosure

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207...

CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

Design/Logic Flaw

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

CVE-2020-12390

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox 76...

CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

CVE-2020-12391

CVE-2020-12391 affects Firefox up to version 76. The issue is that documents formed using data: URLs in an OBJECT element do not inherit the CSP of the creating context, which can allow the execution of scripts that should be blocked, albeit with a unique opaque origin. The description explicitly...

CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

EulerOS 2.0 SP8 : git (EulerOS-SA-2020-1578)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bu...

VK.com: [m.vk.com] XSS на страницах /artist/

XSS при возвращении со страницы артиста. Insufficient validation of the from parameter at the artist page allowed the attacker to inject external URLs into the "Back" link using the LF char: https://m.vk.com/artist/marduk?from=%0A/external.com html When clicked, an ajax request to its URL was sen...

SUSE-RU-2020:1238-1 Recommended update for SUSE Manager Server 4.0

This update fixes the following issues: branch-network-formula: - Handle application/efi mime type - Allow http access to saltboot directory cobbler: - Signatures file now uses 'defaultautoinstall' which fixes import problem happening with some distributions bsc1159010 - Fix for kernel and initrd...

FreeBSD : qutebrowser -- Reloading page with certificate errors shows a green URL (452d16bb-920d-11ea-9d20-18a6f7016652)

Qutebrowser developers report : After a certificate error was overridden by the user, qutebrowser displays the URL as yellow colors.statusbar.url.warn.fg. However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green colors.statusbar.url.successhttps...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1198-1)

This update for webkit2gtk3 fixes the following issues : Security issue fixed : CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to GdkFrameClock...

Oracle Linux 8 : git (ELSA-2020-1980)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1980 advisory. 2.18.4-2 - Update to release 2.18.4 - Resolves: CVE-2020-11008 Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2020-6399 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core version 7.70 and prior versions. Description: The issue is related to an Open Redirect vulnerability that allows a user to be tricked into visiting a specially crafted link, redirecting them to an arbitrary external URL. This is d...

Ubuntu 20.04 LTS : PHP vulnerabilities (USN-4330-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4330-2 advisory. USN-4330-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 20.04 LTS. Tenable has extracted the preceding...

Ubuntu: Security Advisory (USN-4330-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Telegram Input Verification Error Vulnerability

Telegram is an instant messaging mobile application.Telegram Desktop is the desktop version of Telegram. An input validation error vulnerability exists in Telegram Desktop version 2.0.1 and earlier and Telegram Android and IOS version 6.0.1 and earlier, which can be exploited by remote attackers ...