Zynga Faces Lawsuit Over Massive Words with Friends Breach

Mobile game developer Zynga could face a class-action lawsuit stemming from a massive data breach last September, which impacted 218 million users of the Words with Friends mobile app. The news comes as other big names face security incidents: T-Mobile and Carnival Cruise Lines have admitted this...

CVE-2019-8741: Loop with Unreachable Exit Condition

A denial of service issue was addressed with improved input validation...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impac...

PT-2020-10968

Name of the Vulnerable Software and Affected Versions IBM Qradar Advisor versions 1.1 through 2.5 with Watson Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IB...

CVE-2019-18182

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted databa...

Apple Security Update: watchOS 5.3.5

Apple recommends to install security update watchOS 5.3.5 on devices Apple Watch Series 1, Apple Watch Series 2, Apple Watch Series 3, and Apple Watch Series 4 when paired to an iPhone with iOS 12 installed...

CVE-2019-6195: Improper Privilege Management

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

PT-2020-11198

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller versions prior to 3.08 CDI340V Lenovo XClarity Controller versions prior to 3.01 TEI392O Lenovo XClarity Controller versions prior to 1.71 PSI328N Description An authorization bypass exists where a valid authenticate...

Digi ConnectPort LTS 32 MEI

1. EXECUTIVE SUMMARY CVSS v3 2.4 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Digi International Equipment : ConnectPort LTS 32 MEI Vulnerabilities : Unrestricted Upload of File with Dangerous Type, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these...

Threat Source newsletter (Feb. 6, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. There’s never been a better time to be into cyber security podcasts. Our Podcasts page on TalosIntelligence.com got a facelift this week...

Beers with Talos Ep. #71: I Have the Power(Shell)

Beers with Talos BWT Podcast episode No. 71 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Jan. 17, 2020 PowerShell is a frequent flyer in security headlines — a powerful and oft-wielded tool for attacke...

CVE-2020-8088

panellogin.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2014-7238

The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS...

PT-2020-7733

Name of the Vulnerable Software and Affected Versions Contact Form Integrated With Google Maps versions 1.0 through 2.4 Description The issue is related to Stored XSS. Recommendations For versions 1.0 through 2.4, update to a version that contains a fix for this issue...

CVE-2014-7238: Improper Neutralization of Input During Web Page Generation

The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS...

Bit-Flipping Attack

Amendment This was deemed not a vulnerability. Overview parsel is a gem to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Bit-Flipping Attack via the ciphertext function. AES-256-CBC, the construct used in parsel.rb, has no integrity check i.e., the...

OPENSUSE-SU-2020:0003-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 68.3esr MFSA 2019-38 bsc1158328 Security issues fixed: - CVE-2019-17008: Fixed a use-after-free in worker destruction bmo1546331 - CVE-2019-13722: Fixed a stack corruption due to incorrect number of...

CVE-2019-20218

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error...

UBUNTU-CVE-2019-20218

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error...

PT-2020-10376 · Sqlite +6 · Sqlite +6

Name of the Vulnerable Software and Affected Versions: SQLite version 3.30.1 Description: The issue is related to the selectExpander function in the select.c file of SQLite. This function proceeds with WITH stack unwinding even after a parsing error occurs. Recommendations: For SQLite version...