2020 DDoS Extortion Campaign -- A Sequel More Thrilling Than the Original

Costarring Susan McReynolds and Tom Emmons As you might imagine, as the go-to enterprise DDoS mitigation experts, our phones have been "ringing off the hook" as the global extortion DDoS campaign sequel rages on. It's bigger, badder, and features a broader cast of criminal characters than seen...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-58749)

MySQL Server mysqld is the MySQL server, the main program that performs most of the work in a MySQL installation. A security vulnerability exists in the Server: Optimizer component in Oracle MySQL Server 8.0.21 and earlier. An attacker can exploit this vulnerability to cause MySQL Server to hang ...

UBUNTU-CVE-2020-16120

Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a...

up-plastic.com Improper Access Control vulnerability OBB-1384915

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-5631

Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

Acronis: Local Privilege Escalation using System Clean-up functionality

Vulnerability description not provided...

teams.speedupeurope.eu Cross Site Scripting vulnerability OBB-1339073

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Fixed in Apache Tomcat 8.5.58

Moderate: HTTP/2 request mix-up CVE-2020-13943 If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo...

up-station.com Cross Site Scripting vulnerability OBB-1328211

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-1506 Windows Start-Up Application Elevation of Privilege Vulnerability

...

CVE-2020-1506

Technical details about CVE-2020-1506 are not publicly provided in the connected documents. Monitor for updates.

Shipt: Api Token Leaked in [shoppers.shipt.com]

A researcher reported an API key stored in source code that was part of a 3rd party knowledge base integration. The Shipt information security team immediately investigated the report and determined that the API key referenced was a legacy token that was no longer being used. While it didn't...

up-station.com Cross Site Scripting vulnerability OBB-1317082

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Integer overflow

u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and potential information leak' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,...

KLA11954 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Scripting Engine can be exploited remotely to execute...

CVE-2020-6873

A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http links, the remote attackers could use this vulnerability to cause the equipment WEB/TELNET module denial of service and make the equipment be out of management...

PT-2020-19746 · Npm · Worksmith

Name of the Vulnerable Software and Affected Versions: worksmith versions prior to 1.0.1 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions up to and including 1.0.0 of the worksmith package. Recommendations: For versions prior to 1.0.1, updat...

PT-2020-19735 · Npm · Arr-Flatten-Unflatten

Name of the Vulnerable Software and Affected Versions: arr-flatten-unflatten versions up to and including 1.1.4 Description: The issue concerns Prototype Pollution via the constructor. This means that an attacker could potentially manipulate the prototype of an object, leading to unintended...

PT-2021-23698 · Kodi +1 · Kodi +1

Name of the Vulnerable Software and Affected Versions: Kodi xbmc versions up to 19.0 Description: The issue is related to a buffer overflow vulnerability, which allows attackers to cause a denial of service due to the improper length of values passed to istream. Recommendations: For Kodi xbmc...

Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up

By Zara Khan Joseph Sullivan also paid hackers $100,000 in Bitcoin. This is a post from HackRead.com Read the original post: Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up...