SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:1899-1)

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues : Security issues fixed : CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing bsc1173576. CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster bsc1173576. CVE-2020-12417: Memory...

PT-2020-22558

Name of the Vulnerable Software and Affected Versions pcap affected versions not specified Description The issue is related to a crash type of Use-of-uninitialized-value. It involves the pcap filter with aux data, pcap filter, and pcap offline filter functions. No information is provided about th...

CVE-2020-8519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Threat Source newsletter for June 25, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We recently decided to replace our use of the terms "blacklist" and "whitelist" with "block list" and "allow list.” Even though these terms are commonly in use in the security industry, we will not go along with casually assigning...

PT-2020-22035

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read error. Technical details include the involvement of specific functions such as tvb get ipv4 addr with...

PT-2020-22431

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read error. Technical details include the involvement of specific functions: tvb get ipv4 addr with prefix...

New Privacy Features Added to the Upcoming Apple iOS 14 and macOS Big Sur

Unprecedented times call for unprecedented measures. No, we're not talking about 'coronavirus,' the current global pandemic because of which Apple—for the very first time in history—organized its Worldwide Developer Conference WWDC virtually. Here we're talking about a world in which we are all...

Threat Source newsletter for June 18, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. Now that Cisco Live is over, you can access both of Talos’ talks on-demand here if you registered for the online event. The latest Beers with Talos episode covers how to push your career in cyber security forward when you feel lik...

Red Hat OpenShift API Server Resource Management Error Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat that supports building, testing, deploying, and running applications.API Server is one of the API Application Programming Interface servers. The Red Hat OpenShift API Server has a resource management error...

PT-2020-19063

Name of the Vulnerable Software and Affected Versions SAP ERP EA-FINSERV versions 600 through 800 SAP ERP S4CORE versions 101 through 104 Description The issue concerns a missing authorization check in the Statutory Reporting for Insurance Companies module. This allows an authenticated user to vi...

Security update for xawtv (moderate)

openSUSE Security Update: Security update for xawtv Announcement ID: openSUSE-SU-2020:0787-1 Rating: moderate References: 1171655 Cross-References: CVE-2020-13696 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update for...

"Sign in with Apple" Vulnerability

Researcher Bhavuk Jain discovered a vulnerability in the "Sign in with Apple" feature, and received a $100,000 bug bounty from Apple. Basically, forged tokens could gain access to pretty much any account. It is fixed. EDITED TO ADD 6/2: Another story...

Apple Pays $100K Bounty for Critical 'Sign in With Apple' Flaw

A researcher recently found a critical Apple vulnerability that, if exploited, could enable remote attackers to abuse the “Sign in with Apple” feature to take over victims’ third-party application accounts. The security researcher, Bhavuk Jain, reported the flaw to Apple via its bug bounty progra...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Spectrum Conductor and IBM Spectrum Conductor with Spark

Summary There is an unspecified vulnerability CVE-2019-2949 in IBM® Runtime Environment Java™ Version 8 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM Spectrum Conductor 2.3.0, and IBM Spectrum Conductor with Spark 2.2.1. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conduct...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Conductor and IBM Spectrum Conductor with Spark

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM Spectrum Conductor 2.3.0, and IBM Spectrum Conductor with Spark 2.2.1. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM OpenPages with Watson (CVE-2020-4163)

Summary IBM WebSphere Application Server is shipped as a component of IBM OpenPages with Watson. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Threat Source newsletter for May 28, 2020

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We need to start things off by wishing a Happy Birthday to Beers with Talos! The first episode was released on May 12, 2017. To celebrat...

PT-2020-6133

Name of the Vulnerable Software and Affected Versions phpzag live add edit delete data tables records with ajax php mysql affected versions not specified Description The issue is related to a lack of protection against SQL query structure exploitation, potentially allowing a remote attacker to...

Beers with Talos Ep. #81: "The In-Between," Vol. 3

Beers with Talos BWT Podcast episode No. 81 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded May 1, 2020 Sammi is back and the rest of the crew is here to hang out and chat. As is The In-Between Way — we...