CVE-2020-10706

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

Design/Logic Flaw

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

CVE-2020-10706

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

CVE-2020-10706

The CVE-2020-10706 issue affects OpenShift Container Platform where OAuth tokens are not encrypted when data-at-rest encryption is enabled. A backup-access attacker could extract tokens and log in as any user who authenticated within the last 24 hours; tokens become invalid after 24 hours. Red Ha...

CVE-2020-10706: Cleartext Storage of Sensitive Information

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

CVE-2020-12768

An issue was discovered in the Linux kernel before 5.6. svmcpuuninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will...

python: email.utils.parseaddr wrongly parses email addresses

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To header...

python: email.utils.parseaddr wrongly parses email addresses

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To header...

SAS, sweet SAS

As you may already know from our social network posts, we have rescheduled the SAS 2020 conference for November 18-21 due to the COVID-19 pandemic and to ensure your safety. Though we still think that Barcelona is a great place to meet and it will not be a "real" SAS if we cannot hug, shake hands...

itjobs-24.at Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148645 Security Researcher 1orzero Helped patch 102 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting itjobs-24.at website and its users. Following coordinat...

Malicious Package

Overview at-leastoneexistencevalidator is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid usi...

PT-2020-17496

Name of the Vulnerable Software and Affected Versions flatbuffers crate through 2020-04-11 for Rust Description An issue was discovered in the read scalar and read scalar at functions, which are unsound because they allow transmuting values without unsafe blocks. This can lead to creating danglin...

offroad24.at Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1137647 Security Researcher ELProfesor Helped patch 2814 vulnerabilities Received 8 Coordinated Disclosure badges Received 107 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting offroad24.at website a...

Samsung Mobile Device Authorization Issue Vulnerability (CNVD-2020-31813)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have an authorization issue vulnerability that can be exploited by attackers to bypass the lock screen by sending AT commands via USB...

CVE-2018-21092

CVE-2018-21092 affects Samsung mobile devices running M(6.x) and N(7.x). A crafted AT command can be delivered via an NFC tag by the DeviceTest application, leading to potential issue exposure on affected devices. The Red Hat/NVD entries reiterate the same description; no explicit exploitation de...

PT-2020-8736

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with M6.x and N7.x software Description An issue was discovered where a crafted AT command may be sent by the DeviceTest application via an NFC tag. Recommendations For Samsung mobile devices with M6.x software, consider...

CVE-2018-21092: Improper Input Validation

An issue was discovered on Samsung mobile devices with M6.x and N7.x software. A crafted AT command may be sent by the DeviceTest application via an NFC tag. The Samsung ID is SVE-2017-10885 January 2018...

CVE-2016-11041

An issue was discovered on Samsung mobile devices with KK4.4 software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 June 2016...

CVE-2016-11041

The CVE-2016-11041 issue affects Samsung mobile devices on KK (Android 4.4). Affected component: the lockscreen handling; root cause: attackers can bypass the lockscreen by sending an AT command over USB. This vulnerability is documented across multiple sources (Red Hat, NVD, CVE List) with consi...

CVE-2016-11041: Improper Authentication

An issue was discovered on Samsung mobile devices with KK4.4 software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 June 2016...