1602 matches found
CVE-2020-26244: Missing Cryptographic Step
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1 The IdToken signature algorithm was not checked automatically, but only if the expected...
Attacks on industrial enterprises using RMS and TeamViewer: new data
Download full report PDF Executive Summary In summer 2019, Kaspersky ICS CERT identified a new wave of phishing emails containing various malicious attachments. The emails target companies and organizations from different sectors of the economy that are associated with industrial production in on...
Donald Trump Hasn't ‘Already Won’ the Election
Despite the president’s claims of victory, his reelection bid depends on a huge number of votes that have yet to be counted...
PT-2020-16538 · Lightning Network · Lnd
Name of the Vulnerable Software and Affected Versions: LND Lightning Network Daemon versions prior to 0.11.0-beta Description: The issue concerns a problem in the invoice database where LND failed to verify the settlement of an outgoing off-chain HTLC before releasing the preimage while claiming ...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
CVE-2020-16198
When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...
CVE-2020-25735
webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/addannouncement.php, administration/departments.php, administration/locations.php, expenses/claimtype.php, projects/editproject.php, and general/newnotifications.php...
CVE-2020-16198: Protection Mechanism Failure
When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...
CVE-2020-16222: Improper Authentication
In Patient Information Center iX PICiX Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software does not prove or insufficiently proves the claim is correct...
statement-of-claim-against-estate.com Cross Site Scripting vulnerability OBB-1314369
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
I Did Not Write This Book
--- Fake Book Someone published a "book" on Amazon and claimed that I wrote it! I had NOTHING to do with this. I am working with Amazon now to remove it, or at least remove my name. Stay away from this garbage! Update: Thankfully, within a day or so of this post, the true author of this work...
Mail.ru: Subdomain Takeover at blog.instamart.ru
It was possible to claim unused instamart.ru subdomain delegated to external cloud service...
November 11, 2014 update for SharePoint Server 2013 (KB2883055)
November 11, 2014 update for SharePoint Server 2013 KB2883055 This article describes update KB2883055 for Microsoft SharePoint Server 2013 that was released on November 11, 2014. This update has a prerequisite. Fixes and Improvements Fixes the following issue: Assume that you open an Excel workbo...
The Rise and Spread of a 5G Coronavirus Conspiracy Theory
From an interview with an obscure Belgian doctor to apparent arson attacks in the UK, the unfounded claim that the pandemic is linked to 5G has spread unlike any other...
UBUNTU-CVE-2020-11441
DISPUTED phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable."...
Mail.ru: vk.com profile page takeover on https://cabinet.am.ru/
Description Hi team, While exploring https://cabinet.am.ru/ domain I found this site points to some social media accounts, One of them was a vk.com profile as https://vk.com/amrusocial but when I opened that link it showed me a 404 error so I successfully could register an account on vk.com and...
How to Get Your Yahoo Breach Settlement Money
If you had a Yahoo account from 2012 to 2016, you probably have $100 coming your way...
CVE-2019-20437
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as t...
CVE-2019-20436
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configurin...
CVE-2019-20436
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configurin...