CVE-2020-0099

In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. This could lead to local escalation of privilege via tapjacking with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2020-9001

This CVE entry is rejected/not used; it does not represent an active vulnerability.

CVE-2020-24336

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. Thi...

CVE-2020-24336

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. Thi...

Buffer overflow

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. Thi...

Mount Locker Ransomware Offering Double Extortion Scheme to Other Hackers

A relatively new ransomware strain behind a series of breaches on corporate networks has developed new capabilities that allow it to broaden the scope of its targeting and evade security software—as well as with ability for its affiliates to launch double extortion attacks. The MountLocker...

GitLab File Read Remote Code Execution Exploit

This Metasploit module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails secretkeybase, and gains remote code execution with a deserialization vulnerability of a signed experimentationsubjectid...

Photon OS 3.0: Curl PHSA-2020-3.0-0174

An update of the curl package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0174. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144069;...

Wiz comes out of stealth with $100M Series A funding to reinvent cloud security

Today, we’re announcing a milestone in that journey: a $100M Series A funding round led by Index Ventures, Sequoia Capital, Insight Partners, and Cyberstarts...

KB4592504: Windows Server 2008 December 2020 Security Update

The remote Windows host is missing security update 4592504 or cumulative update 4592498. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. CVE-2020-17098 C Tenable Network...

Payment Card Skimmer Group Using Raccoon Info-Stealer to Siphon Off Data

A cybercrime group known for targeting e-commerce websites unleashed a "multi-stage malicious campaign" earlier this year designed with an intent to distribute information stealers and JavaScript-based payment skimmers. In a new report published today and shared with The Hacker News,...

ASB-A-157905870

Bulletin has no description...

ASB-A-157906329

Bulletin has no description...

ASB-A-168050601

Bulletin has no description...

Oracle Linux 8 : thunderbird (ELSA-2020-5236)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5236 advisory. 78.5.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.5.0-1 - Update to 78.5.0 build3 Tenable has...

ASB-A-168049958

Bulletin has no description...

ASB-A-168050278

Bulletin has no description...

ASB-A-168049960

Bulletin has no description...

Synology SafeAccess 跨站脚本漏洞

Synology SafeAccess is an appliance from China-based Synology Inc. that can configure the security of your network environment. The appliance can monitor users' Internet behavior, set Internet schedules and time quotas, apply web filters to protect specific users, and protect all devices in the...