7569 matches found
Cross site scripting
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting...
A week in security (February 25 – March 3)
Last week, we delved into the realm of K-12 schools and security, explored the world of compromised websites and Golang bruteforcers, and examined the possible realms of pay for privacy. We also looked at identity management solutions, Google’s Universal Read Gadget, and did the deepest of dives...
Spectre, Google, and the Universal Read Gadget
Spectre, a seemingly never ending menace to processors, is back in the limelight once again thanks to the Universal Read Gadget. First seen at the start of 2018, Spectre emerged alongside Meltdown as a major potential threat to people’s system security. Meltdown and Spectre Meltdown targeted Inte...
SQL Injection Vulnerability at the login of Central Message Board v3.2
Central Message Board is an online message system developed by Central Studio using oop. Azeus Message Board v3.2 SQL injection vulnerability exists at the login. Azeus Message Board v3.2 fails to filter the name parameter in the background login, allowing attackers to exploit the vulnerability f...
New Flaws Re-Enable DMA Attacks On Wide Range of Modern Computers
Security researchers have discovered a new class of security vulnerabilities that impacts all major operating systems, including Microsoft Windows, Apple macOS, Linux, and FreeBSD, allowing attackers to bypass protection mechanisms introduced to defend against DMA attacks. Known for years, Direct...
Multiple Vulnerabilities in Splunk Universal Forwarder
The Splunk Universal Forwarder collects data from a data source or another forwarder and sends it to a forwarder or a deployment of Splunk. The Universal Forwarder can send data to SplunkEnterprise, Splunk Light, or Splunk Cloud, and it also replaces the Splunk Enterprise Light Forwarder and is...
British Airways Entertainment System Buffer Overflow Vulnerability
The British Airways Entertainment System is an in-flight audio-visual entertainment system. A security vulnerability exists in the British Airways Entertainment System installed on Boeing 777-36NER and other aircraft, which arises from a program that does not prevent the USB charge/digit transfer...
CVE-2018-20785
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, thi...
Intel USB 3.0 eXtensible Host Controller Driver Local Code Injection Vulnerability
Intel USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 is a USB Universal Serial Bus 3.0 eXtensible Host Controller Driver for the Windows 7 platform from Intel Corporation. Host Controller Driver for Microsoft Windows 7. A code injection vulnerability exists in the installer in...
UBUNTU-CVE-2018-20340
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is...
Yokogawa SMARTDAC+ STANDARD Universal Viewer Detection (Windows SMB Login)
Detects the installed version of Yokogawa SMARTDAC+ STANDARD Universal Viewer for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Universal Password Login Vulnerability in the User Management Platform of Beijing Yiwei Cloud Data Technology Co.
Beijing Yiwei Cloud Data Technology Co., Ltd. is an innovative enterprise focusing on providing Internet basic data services and data operation for small and medium-sized enterprises. There is a universal password login vulnerability in the user management platform of Beijing Yiwei Cloud Data...
The vulnerability of the SAP Business Warehouse universal data integration platform, related to incorrect processing of data provided by users, allows a perpetrator to implant arbitrary codes.
The vulnerability of the SAP Business Warehouse Universal Data Integration platform is related to the improper processing of data provided by users. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...
About the security content of Safari 12.0.3
About the security content of Safari 12.0.3 This document describes the security content of Safari 12.0.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
CVE-2018-20233
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...
Xxe
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...
CVE-2018-20233
CVE-2018-20233 concerns the Atlassian Universal Plugin Manager (UPM) plugin bundled with Atlassian products. The vulnerability is an XML External Entity (XXE) issue in the parsing of atlassian plugin XML files inside an uploaded JAR, exploitable by remote attackers who already have system adminis...
CVE-2018-20233
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...
