The vulnerability arises from insufficient checking of update files in the client update folder of the VipNet Client information protection software. This allows a perpetrator to execute arbitrary code.

The vulnerability of the VipNet Client information protection software lies in insufficient checks on access rights to the update folder, as well as insufficient checks on the integrity and authenticity of update files. Exploiting this vulnerability could allow an attacker, operating locally, to...

Lazarus Targets Defense Companies with ThreatNeedle Malware

The prolific North Korean APT known as Lazarus is behind a spear-phishing campaign aimed at stealing critical data from defense companies by leveraging an advanced malware called ThreatNeedle, new research has revealed. The elaborate and ongoing cyberespionage campaign used emails with COVID-19...

Kaspersky Security Vulnerabilities

Kaspersky module is an application component of the Russian company Kaspersky Kaspersky. It provides antivirus protection. A security vulnerability exists in Kaspersky that allows loading of untrusted UEFI modules due to their insufficient authenticity checks...

The vulnerability of the Kaspersky Endpoint Security anti-virus protection component and the Kaspersky Rescue Disk boot disk, related to insufficient verification of data authenticity, allows attackers to bypass the UEFI Secure Boot security mechanism.

The vulnerability of the Kaspersky Endpoint Security anti-virus protection component and the Kaspersky Rescue Disk boot disk is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow a remote attacker to bypass the UEFI Secure Boot security mechanism...

The vulnerability of the mod_remoteip and mod_rewrite modules in the Apache HTTP Server allows a hacker to replace an IP address.

The vulnerability of the modremoteip and modrewrite modules in the Apache HTTP Server is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to perform IP address substitution attacks...

Siemens RUGGEDCOM ROX II

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: RUGGEDCOM ROX IIB Vulnerabilities: Improper Input Validation, NULL Pointer Dereference, Out-of-Bounds Write, Insufficient Verification of Data Authenticity, Improper Certificate...

CVE-2020-9141

There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosure and malfunctions due to insufficient verification of data authenticity...

CVE-2020-9141

There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosure and malfunctions due to insufficient verification of data authenticity...

Privilege escalation

There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosure and malfunctions due to insufficient verification of data authenticity...

CVE-2020-9141

Technical details for CVE-2020-9141 are not publicly available in the provided documents. No affected products, versions, or remediation are specified. Monitor for updates in forthcoming disclosures from vendors and security bulletins.

The vulnerability of the Firefox ESR and Firefox web browsers’ parsing module, as well as the Thunderbird email client, stems from a lack of mechanisms for verifying data authenticity. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Firefox ESR and Firefox web browsers’ parsing module, as well as the Thunderbird email client, is related to a lack of mechanisms for verifying data authenticity. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its...

The vulnerability of the unified information system for government management, Parus-Budget, due to insufficient verification of data authenticity, allows a perpetrator to execute arbitrary codes.

The vulnerability of the unified information system for government management, Parus-Budget, is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands by replacing the update file...

CVE-2020-26281

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

Cross site request forgery (csrf)

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

The vulnerability of the network software tool Envoy, related to insufficient verification of data authenticity, allows a hacker to gain access to protected information.

The vulnerability of the network software tool Envoy is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

The vulnerability of the Drupal CMS system, related to insufficient verification of the authenticity of executed queries, allows a hacker to execute arbitrary code.

The vulnerability of the Drupal CMS system is related to insufficient verification of the authenticity of executed queries. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

Detecting Deep Fakes with a Heartbeat

Researchers can detect deep fakes because they dont convincingly mimic human blood circulation in the face: In particular, video of a persons face contains subtle shifts in color that result from pulses in blood circulation. You might imagine that these changes would be too minute to detect merel...

Cross-Site Request Forgery (CSRF)

cfme-gemset is vulnerable to cross-site request forgery CSRF. Lack of authenticity verification of requests in the API notifications allows an attacker to submit requests on behalf of an authenticated user...

Apache HTTP Server Data Forgery Issue Vulnerability

Apache HTTP Server is the United States Apache Software Apache Software Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A data forgery vulnerability exists in Apache HTTP Server. The vulnerability arises from a network system or...