jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-13941

A flaw was found in Solr. The Replication handler allows commands backup, restore, and delete backup that take non-validated allocation parameters which may result in the exfiltration of sensitive data such as OS user hashes NTLM/LMhashes. The highest threat from this vulnerability is to data...

PT-2020-6462

Name of the Vulnerable Software and Affected Versions QEMU version 5.0.0 Description The issue is related to a buffer over-read in the QEMU hardware emulation, specifically in the hw/usb/hcd-ohci.c file. This can allow an attacker to access confidential data, compromise data integrity, and cause ...

The vulnerability of the Installation component of the Oracle Hospitality Reporting and Analytics software platform, related to insufficient validation of input data, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Oracle Hospitality Reporting and Analytics software installation component is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the master.py component in the Configuration Management system and the remote execution of SaltStack operations allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the master.py component of the Configuration Management system and the remote execution of SaltStack operations is related to the lack of a mechanism for verifying input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidentia...

The vulnerabilities of the formatting.php and SanitizeFileName.php components of the WordPress content management system allow attackers to compromise data integrity.

The vulnerability of the formatting.php and SanitizeFileName.php components of the WordPress content management system is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

The vulnerability of the wp_insert_user function and testWPUpdateUser_should_deleteUsersLugsCache (user.php) in the WordPress content management system allows attackers to access sensitive data and compromise its integrity.

The vulnerability of the wpinsertuser function and testwpupdateusershoulddeleteuserslugscache in user.php of the WordPress content management system is related to a lack of password recovery mechanism. Exploiting this vulnerability could allow an attacker to gain access to sensitive data and...

The vulnerability of the stats() method (class-wp-object-cache.php) in the WordPress content management system allows a hacker to compromise data integrity.

The vulnerability of the stats method in the WordPress content management system’s class-wp-object-cache.php file is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an attacker to compromise data integrity...

The vulnerability of the `render_block_core_search` and `render_block_core_rss` functions in the WordPress content management system allows attackers to compromise the integrity of data.

The vulnerability of the renderblockcoresearch and renderblockcorerss functions in the WordPress content management system is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow a malicious actor to compromise the integri...

The vulnerability of the WordPress website content management system, related to deficiencies in the security measures used to protect web page structures, allows attackers to compromise data integrity.

The vulnerability of the WordPress website content management system is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

New Relic: Sending thousands of notifications with single request

Hello, while testing your mobile api an endpoint got my attention. This endpoint was: https://api.newrelic.com/api/ios/v3/devices/update.json?operation=register I immediately checked if server is validating the integrity of data or not. After finding out there is no validation, I added around 500...

kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c

A flaw was found in the Linux kernel. The Marvell mwifiex driver allows a remote WiFi access point to trigger a heap-based memory buffer overflow due to an incorrect memcpy operation. The highest threat from this vulnerability is to data integrity and system availability...

CVE-2020-8116

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

The vulnerability of the ChromeDriver component of the Google Chrome browser allows a perpetrator to compromise data integrity.

The vulnerability of the ChromeDriver component of the Google Chrome browser is related to a lack of standard permission mechanisms. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted request...

The vulnerability of the TabStrip module in the Google Chrome browser allows a hacker to compromise data integrity.

The vulnerability of the TabStrip module in Google Chrome browser is related to the lack of standard permission mechanisms. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially created extension...

The vulnerability of Google Chrome’s general access mechanism allows a perpetrator to compromise data integrity.

The vulnerability of the Google Chrome browser’s general access mechanism is related to a bug in the system’s resource management mechanism. Exploiting this vulnerability allows an attacker to influence data integrity through a specially created HTML page...