CVE-2020-8647

A flaw was found in the Linux kernel’s virtual console resize functionality. An attacker with local access to virtual consoles can use the virtual console resizing code to gather kernel internal data structures. Mitigation The attack vector can be significantly reduced by preventing users from...

CVE-2020-8648

A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This flaw allows a local user to crash the system. Mitigation Mitigation for this issue is either not available or the currently available options dont meet the Red Hat Product Security criteria...

Unable to Add Workers to Bahrain or Hong Kong Regions

Challenge When adding a worker instance to the Bahrain or Hong Kong regions, the following error occurs: AWS was not able to validate the provided access credentials. Cause Veeam Backup for AWS uses the Global STS endpoint. Solution To add a worker to the Bahrain or Hong Kong regions, do the...

Console Driver Job Object Process Limit Bypass

The console driver in Windows 8.1 can be used to break out of a process with an active process job limit. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: Attacker requires too much control in advance for this to be useful. Assessed Attacker Value: 1 Assessed Attacker Value:...

Intel Raid Web Console 2 Elevation of Privilege Vulnerability

Intel Raid Web Console 2 is a web-based application from Intel Corporation that provides monitoring, maintenance, troubleshooting, and configuration capabilities for Intel RAID products. An elevation of privilege vulnerability exists in Intel Raid Web Console 2. An attacker can exploit the...

Intel RAID Web Console 3 (RWC3) for Windows Elevation of Privilege Vulnerability

Intel RAID Web Console 3 RWC3 is a Web-based application from Intel Corporation that provides monitoring, maintenance, troubleshooting, and configuration capabilities for Intel RAID products. Intel RAID Web Console 3 RWC3 for Windows elevation of privilege vulnerability. An attacker can exploit t...

Security Bulletin: A security vulnerability has been identified in Websphere Application Server shipped with Predictive Customer Intelligence (CVE-2017-1501).

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...

Intel Patches High-Severity Flaw in Security Engine

Intel is warning of a high-severity flaw in the firmware of its converged security and management engine CSME, which if exploited could allow privilege escalation, denial of service and information disclosure. CSME powers Intel’s Active Management System hardware and firmware technology, used for...

The vulnerability of the Console component of Oracle WebLogic Server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Oracle WebLogic Server application server’s Console component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of the Console component of Oracle WebLogic Server allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Console component of Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...

The vulnerability of the Console component of Oracle WebLogic Server allows a attacker to cause a partial service failure.

The vulnerability of the Console component of Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to cause a partial service outage using the HTTP protocol...

CVE-2020-1697

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

CVE-2020-1697

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

Cross site scripting

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

CVE-2020-1697

CVE-2020-1697 affects Keycloak versions before 9.0.0 where admin console links to external applications (Application Links) are not validated, allowing an authenticated user to craft links that trigger Stored XSS cross-realm. The issue is evidenced in multiple feeds (Red Hat advisories explicitly...

CVE-2020-1697

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

FortiAP system command injection through ifconfig command

A system command injection vulnerability in the FortiAP CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands...

Dota 2 7.23f - Denial of Service (PoC)

Exploit Title: Dota 2 7.23f - Denial of Service PoC Google Dork: N/A Date: 2020-02-05 Exploit Author: Bogdan Kurinnoy [email protected] bi7s Vendor Homepage: https://www.valvesoftware.com/en/ Software Link: N/A Version: 7.23f Tested on: Windows 10 x64 CVE : CVE-2020-7949 Valve Dota 2...

CVE-2020-1697

A flaw was found during the assessment of the Admin Console application for Keycloak, where it was found that Application Links to external applications are not validated properly. An attacker could use this flaw to cause Stored XSS attacks...

Security Bulletin: Aspera Web Faspex application is affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary IBM Aspera Faspex has addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is mos...