9997 matches found
SUSE SLED15 / SLES15 Security Update : permissions (SUSE-SU-2020:0547-1)
This update for permissions fixes the following issues : Security issues fixed : CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed bsc1148788 CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities f...
SUSE SLES12 Security Update : permissions (SUSE-SU-2020:0545-1)
This update for permissions fixes the following issues : Security issues fixed : CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities for mrsh and wodim bsc1163922. Non-security issues fixed: Fixed a regression where chkstat broke when /proc was not available bsc1160764,...
SUSE-SU-2020:0547-1 Security update for permissions
This update for permissions fixes the following issues: Security issues fixed: - CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed bsc1148788 - CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities...
VulnCheck KEV: CVE-2020-36853
The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated...
CVE-2019-5137
The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware version 1.13...
CVE-2020-8498
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...
CVE-2020-8498
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...
Portfolio Filter Gallery < 1.1.3 - CSRF & Reflected XSS
Lack of CSRF checks on the Filters page could allow attackers to add/edit/update/delete categories and delete all categories, as well as perform reflected XSS attacks. v1.0.8 fixed the reflected XSS, however no CSRF check on delete and deleteallcategory actions v1.1.0 released, no additional fix...
Portfolio Filter Gallery < 1.1.3 - CSRF & Reflected XSS
Lack of CSRF checks on the Filters page could allow attackers to add/edit/update/delete categories and delete all categories, as well as perform reflected XSS attacks. v1.0.8 fixed the reflected XSS, however no CSRF check on delete and deleteallcategory actions v1.1.0 released, no additional fix...
Awesome Support < 6.0.0 - Stored XSS via Ticket Title
The lack of sanitisation in the posttitle of a ticket could allow users with the Support Supervisor capability to create tickets containing XSS payloads. The risk is relatively low, as CSRF checks are in place and the affected role is close to an admin one. Using the DISALLOWUNFILTEREDHTML consta...
Combining AI and Playbooks to Predict Cyberattacks
When organizations invest in AI, they are not only able to automate menial tasks like patching, but they can also create an automated system that looks for and discovers attacks, not only after the fact, but even before they occur. This predictive capability becomes increasingly necessary as...
Linux 5.3 - Privilege Escalation via io_uring Offload of sendmsg() onto Kernel Thread with Kernel Creds
Linux 5.3 - Privilege Escalation via iouring Offload of sendmsg onto Kernel Thread with Kernel Creds Since commit 0fa03c624d8f "iouring: add support for sendmsg", first in v5.3, iouring has support for asynchronously calling sendmsg. Unprivileged userspace tasks can submit IORINGOPSENDMSG...
Microsoft Remote Desktop Services (RDP7) Windows XP Multiple Information Leak Vulnerabilities
Summary Exploitable information leak vulnerabilities exists in the RDP7 implementation of Microsoft’s Remote Desktop Services on Windows XP. Various aspects of the T.128 protocol, such as capability negotiation, can cause an information leak, which can provide an attacker information about the...
CVE-2019-15433
The Samsung A3 Android device with a build fingerprint of samsung/a3y17ltedx/a3y17lte:8.0.0/R16NW/A320YDXU4CSB3:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000000, versionName=7.0.0.0 that allows other pre-installed apps t...
CVE-2019-15441
The Samsung on7xeltelgt Android device with a build fingerprint of samsung/on7xeltelgt/on7xeltelgt:8.1.0/M1AJQ/G610LKLU2CSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other...
CVE-2012-1170
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough...
CVE-2012-1170
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough Versions 2.2 to 2.2.1+ affected...
Design/Logic Flaw
The Samsung on7xeltelgt Android device with a build fingerprint of samsung/on7xeltelgt/on7xeltelgt:8.1.0/M1AJQ/G610LKLU2CSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other...
Design/Logic Flaw
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough...
CVE-2012-1170
The CVE-2012-1170 entry affects Moodle prior to 2.2.2, describing an issue in the external enrolment plugin context where capability checks are not thorough. The vulnerability is tied to insufficient permission validation in the enrolment workflow, enabling potential elevation of access via that ...