14662 matches found
JVN#00414047: Studyplus App uses a hard-coded API key for an external service
Studyplus App provided by Studyplus Inc. uses a hard-coded API key for an external service CWE-798. Impact API key for an external service may be obtained by analyzing data in the app. Note that a user is not directly affected by this vulnerability. Solution Update the Application Update the...
The vulnerability of the smb_fdata() function in the tcpdump utility for intercepting and analyzing network traffic allows a hacker to induce a service failure.
The vulnerability of the smbfdata function smbutil.c in the tool for capturing and analyzing network traffic, tcpdump, is caused by an uncontrolled recursion. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
CVE-2020-2316
Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2020-2316
Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
Cross site scripting
Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2020-2316
Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2020-2316
The CVE-2020-2316 vulnerability affects Jenkins’ Static Analysis Utilities Plugin (versions 1.96 and earlier). The issue is a failure to escape the annotation message shown in tooltips, causing a stored cross-site scripting (XSS) vulnerability. Exploitation is possible by attackers who have Job/C...
llvm-toolset:rhel8 bug fix and enhancement update
LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
New Kimsuky Module Makes North Korean Spyware More Powerful
A week after the US government issued an advisory about a "global intelligence gathering mission" operated by North Korean state-sponsored hackers, new findings have emerged about the threat group's spyware capabilities. The APT — dubbed "Kimsuky" aka Black Banshee or Thallium and believed to be...
Security Bulletin: Vulnerability related to unauthenticated uploads in Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2020-13957)
Summary Unauthenticated configset uploads vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis have been addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper access...
WAGO Series 750-88x and 750-352 (Update A)
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: WAGO Equipment: 750-88x and 750-352 Vulnerability: Uncontrolled Resource Consumption 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-308-01 WAGO...
Unpatched Windows Zero-Day Exploited in the Wild for Sandbox Escape
A high-severity Windows driver bug is being exploited in the wild as a zero-day. It allows local privilege escalation and sandbox escape. The security vulnerability was disclosed by Google Project Zero just seven days after it was reported, since cybercriminals are already exploiting it, accordin...
Exploit for Infinite Loop in Apache Tomcat
Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020...
The vulnerability of the icmp_print() function in the tcpdump utility for capturing and analyzing network traffic allows a hacker to induce a service failure.
The vulnerability of the icmpprint function print-icmp.c in the tcpdump tool for capturing and analyzing network traffic involves reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
CISA and CNMF Identify a New Malware Variant: Zebrocy
Content: The Cybersecurity and Infrastructure Security Agency CISA and the Department of Defense DOD Cyber National Mission Force CNMF have identified a malware variant—referred to as Zebrocy—used by a sophisticated cyber actor. In addition, U.S. Cyber Command has released the malware sample to t...
CISA, FBI, and CNMF Identify a New Malware Variant: ComRAT
The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, and the Department of Defense Cyber National Mission Force CNMF have identified a malware variant—referred to as ComRAT—used by the Russian-sponsored advanced persistent threat APT actor Turla. In...
Mining Splunk's Internal Logs
Splunk is great about logging its warnings and errors, but it wont tell you about them - you have to ask! As the leading machine-generated data analysis software, its not surprising that Splunk excels at creating robust logs. The current version of Splunk Enterprise v 8.05 generates 22 different...
New Research Reveals the Hidden Downsides of Link Previews
The feature is convenient, but it can also leak sensitive data, consume bandwidth, and drain batteries. And some sites are worse than others...
Opera Receives DevSecOps All-Star Award at SnykCon 2020
News Opera Receives DevSecOps All-Star Award at SnykCon 2020 Share October 28th, 2020 AtSnykCon 2020, Opera received the DevSecOps All-Star Award for leveraging Snyk to bring a complete and fully automated DevSecOps process into a secure software development lifecycle. Opera was represented by...