DEBIAN-CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking...

CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

Design/Logic Flaw

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

Mandatory IoT Security in the Offing with U.K. Proposal

The U.K. government has unveiled a proposed law aimed at securing internet of things IoT devices, which have historically been riddled with basic security issues. The drafted law, announced on Monday, comprises three main mandates for IoT manufacturers. First, all consumer IoT device passwords mu...

CVE-2013-0196

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...

PT-2019-6836 · Red Hat · Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: OpenShift Enterprise version 1.2 Description: A CSRF issue was found in the web console, which uses 'Basic authentication', and the REST API lacks a CSRF attack protection mechanism. This allows an attacker to obtain credentials and the...

Apache Solr Remote Code Execution via Velocity Template

This module exploits a vulnerability in Apache Solr 'Apache Solr Remote Code Execution via Velocity Template', 'Description' = %q This module exploits a vulnerability in Apache Solr = 8.3.0 which allows remote code execution via a custom Velocity template. Currently, this module only supports Sol...

The vulnerability of VBScript script handlers in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of VBScript script handlers in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using a specially crafted web page or document...

CVE-2019-19796

Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file...

CVE-2019-19796

Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file...

CVE-2019-19796

Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file...

CVE-2019-19796

Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file...

DEBIAN-CVE-2019-19720

Yabasic 2.86.1 has a heap-based buffer overflow in the yylex function in flex.c via a crafted BASIC source file...

CVE-2019-19720

Yabasic 2.86.1 has a heap-based buffer overflow in the yylex function in flex.c via a crafted BASIC source file...

CVE-2019-19720

Yabasic 2.86.1 has a heap-based buffer overflow in the yylex function in flex.c via a crafted BASIC source file...

UBUNTU-CVE-2019-19720

Yabasic 2.86.1 has a heap-based buffer overflow in the yylex function in flex.c via a crafted BASIC source file...

CVE-2019-19720

Yabasic 2.86.1 has a heap-based buffer overflow in the yylex function in flex.c via a crafted BASIC source file...

Xmas Light Security Improves… a bit

We've looked at smart Xmas lights before; whilst they were vulnerable, there was no consequence to the hack other than making them flash in a different order! In 2018 we looked at the all-new Twinkly smart festive lights. We found a number of security issues, reported them to the vendor and to a...

CVE-2013-0243

haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections...