CVE-2020-10096

CVE-2020-10096 affects Zammad 3.0–3.2 and involves a failure to prevent caching of confidential data in browser memory. An attacker who remotely compromises or physically gains access to a user’s workstation can read sensitive information from the browser cache without authenticating to the appli...

Top 10 Most Innovative Cybersecurity Companies After RSA 2020

The RSA Conference, the world's leading information security conference and exposition, held its 29th annual event in San Francisco last week. According to the organizers, over 36,000 attendees, 704 speakers, and 658 exhibitors gathered at the Moscone Center to discuss privacy, Machine Learning,...

CVE-2018-14705 Lack of Authentication/Authorization on Administrative Web Pages

In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these...

The vulnerability of SAP BusinessObjects Business Intelligence platform lies in its lack of encryption for user-input data, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the SAP BusinessObjects Business Intelligence platform exists due to deficiencies in the encryption of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

5 High Impact Flaws Affect Cisco Routers, Switches, IP Phones and Cameras

Several Cisco-manufactured network equipments have been found vulnerable to five new security vulnerabilities that could allow hackers to take complete control over them, and subsequently, over the enterprise networks they power. Four of the five high-severity bugs are remote code execution issue...

IRS Launches “Identity Theft Central” Webpage

The Internal Revenue Service IRS has launched its “Identity Theft Central” webpage to provide 24/7 access to online information regarding tax-related identity theft and data security protection. Tax-related identity theft occurs when someone steals personal information to commit tax fraud. The...

CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

fanfox.net Cross Site Scripting vulnerability OBB-1082408

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Wawa Breach May Have Compromised More Than 30 Million Payment Cards

In late December 2019, fuel and convenience store chain Wawa Inc. said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen...

Insolar: XDSI(Cross Domain Script Inclusion)

Summary: As I did not get the proper CWE id over id to add but the proper CWE id is 829: The page includes one or more script files from a third-party domain. Here you are including in your website, someone else's code; You don't have any control over what is in that code, and you don't have any...

fondtaktak.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1076299 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2020-2704

CVE-2020-2704 affects Oracle VM VirtualBox (Core) with affected versions prior to 5.2.36, 6.0.16, and 6.1.2. The vulnerability is described as easily exploitable, allowing a low-privileged attacker with local logon to compromise the VirtualBox instance and potentially gain access to all data with...

CVE-2020-2716

The CVE-2020-2716 entry concerns Oracle Banking Corporate Lending (Core) within Oracle Financial Services Applications. Affected versions are 12.3.0–12.4.0 and 14.0.0–14.3.0. The vulnerability enables a low-privileged, network-accessible attacker to compromise the system via HTTP, potentially lea...

CVE-2020-2688

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications component: Object Migration. Supported versions that are affected are 8.0.4-8.0.8. Easily exploitable vulnerability allows low privileged attacker with network...

CVE-2020-2678

CVE-2020-2678 affects Oracle VM VirtualBox (Core) with vulnerable versions prior to 5.2.36, 6.0.16 and 6.1.2. The issue allows a low-privileged, logon-authenticated attacker to compromise VirtualBox, potentially leading to unauthorized creation, deletion or modification of data, and unauthorized ...

Unspecified Vulnerability in Oracle GraalVM Enterprise Edition (CNVD-2020-09692)

Oracle GraalVM is the United States Oracle Oracle company's set of instant compiler written in the Java language. The product supports a variety of programming languages and execution modes.GraalVM Enterprise Edition is the enterprise version of GraalVM. An unspecified vulnerability exists in...

CVE-2012-3823

Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved...

CVE-2012-3823

Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved...

IR & Forensics in the Cloud

More and more organisations are moving their business to the cloud. This makes securing data and being able to respond effectively to incidents in cloud environments an important topic. Having the skills on hand to properly collect digital forensics data in response to a legal dispute or during a...