CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

CVE-2018-4387: Exposure of Sensitive Information to an Unauthorized Actor

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

PT-2019-10901

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1 Description: A lock screen issue allowed unauthorized access to photos via the Reply With Message feature on a locked device. This was addressed with improved state management. Recommendations: For versions prior to...

Mimikatz v2.2.0 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. But that's not all!...

UBUNTU-CVE-2019-8323

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilitieswithresponse may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur...

PT-2019-16746

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Description A vulnerability was found where the get with capability join and get users by capability functions did not account for context freezing when checking user capabilities. Recommendations For versions...

Cyber Security Week in Review (March 22)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here. Top headlines this week Norwegian aluminum company...

PT-2019-9727

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 11 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure withi...

PT-2019-9634

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions up to and including 7.1.0 TIBCO JasperReports Server Community Edition versions up to and including 7.1.0 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3 TIBCO Jaspersoft f...

Cyber Security Week in Review (March 1)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here. Top headlines this week Drupal patched a “highly...

PT-2019-9976

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 11 Description The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences /../ to upload...

CVE-2018-2006: Improper Limitation of a Pathname to a Restricted Directory

IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to upload arbitrary files to the system. IBM X-Force ID: 155008...

GHSA-9JF3-F2PG-7868 nw-with-arm downloads Resources over HTTP

Affected versions of nw-with-arm insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

nw-with-arm downloads Resources over HTTP

Affected versions of nw-with-arm insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

DEBIAN-CVE-2019-7659

Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service application abort or possibly have unspecified other impact if a server application is built with the -DWITHCOOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ librarie...

Design/Logic Flaw

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

CVE-2019-7249

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

CVE-2019-7249: Time-of-check Time-of-use (TOCTOU) Race Condition

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

PT-2019-18479

Name of the Vulnerable Software and Affected Versions Keybase versions prior to 2.12.6 Description The issue in Keybase allows one user of the system without root access to tamper with another's installs due to time-to-check-time-to-use bugs in the move RPC to the Helper. Recommendations For...