57 matches found
ALPINE-CVE-2022-42320
Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries...
U.S. Dept Of Defense: Pull Any Automated Record Brief
The vulnerability allows an authenticated user to request other soldiers' Automated Record Briefs ARBs or Officer Record Briefs ORBs by manipulating the URL. The URL contained an identifier that could be incrementally changed to access the records of other individuals. This vulnerability exposed...
CVE-2021-1074
NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged system access may be able to replace an application resource with malicious files. This attack requires a user with system administration rights to execute the installer and requires...
CVE-2021-24032
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to...
CVE-2020-25655
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permissio...
Huawei Data Communication: Read display ospf peer brief command
Get the current ospf peer brief configuration of the VRP device. Please set screen-length of user-interface to 0, otherwise not all configurations may returned. Note: This script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions...
U.S. Dept Of Defense: ██████ Authenticated User Data Disclosure
Background The Air Force’s ███ application is exposing members’ personal information to other users with access to the applocaton. We’ve identified two specific issues, but there may be other similar problems in the same vein as the ones described here. The underlying problem appears to be that...
KeystoneJS Cross-Site Scripting Vulnerability (CNVD-2017-32888)
KeystoneJS is an open source framework for developing database-driven websites, applications and APIs. A cross-site scripting vulnerability exists in versions of KeystoneJS prior to 4.0.0-beta.7. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML with the help ...
Do the Police Need a Search Warrant to Access Cell Phone Location Data?
The US Supreme Court is deciding a case that will establish whether the police need a warrant to access cell phone location data. This week I signed on to an amicus brief from a wide array of security technologists outlining the technical arguments as why the answer should be yes. Susan Landau...
LinkedIn Asks for Transparency on National Security Letters
LinkedIn on Tuesday joined the fray of Internet companies requesting permission from the Foreign Intelligence Surveillance Court to publish data on the number of National Security Letters it receives. Unlike Google, Microsoft and others that have petitioned the FISA court to lift its ban on the...
Google: Gmail Users Should Have No Expectation of Privacy
Edward Snowden has done enough to highlight how vulnerable electronic communications are to surveillance and Gmail users should not expect privacy from Google. Lavabit is no more. Silent Circle has shuttered its secure email service. A California watchdog group says that Gmail users now have a...
EFF: Forced Decryption Violates Fifth Amendment
If the government would like to force Jeffrey Feldman to decrypt the contents of the hard-drives and Dell computer found in his apartment, then they must offer him immunity and cannot use any of the information found on the devices as part of their case against him. That is what the Electronic...
ISS Brief: Remote Compromise and Denial of Service Vulnerability in PHP
TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- This document is an ISS X-Force Securit...
Netscape E.S. Web Publisher ACL Vulnerabilities
Vendor: Netscape Product: Enterprise Server 3.5.1 and others? Specifics: Netscape Web Publisher Vulnerability Briefing: A very wide problem with ACL settings and default settings with Netscape Enterprise Server Publisher. Description: With the default installation of Netscape Enterprise Server...
