U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI

Hello, I found an outdated version of Telerik Web UI v2016.2.607.40 at the following URL: https://███/Telerik.Web.UI.WebResource.axd?type=rau. This means that we can achieve full RCE by chaining two different CVEs: CVE-2017-11317, which allows us to upload arbitrary files on the server, and...

CVE-2020-2584

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

PT-2020-2005

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 74.0.1 Firefox ESR versions prior to 68.6.1 Thunderbird versions prior to 68.7.0 Description The issue is related to a use-after-free condition in the ReadableStream component, potentially allowing a remote attacker t...

WordPress Randy Peterman Murph StatTraq SQL Injection Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A SQL injection vulnerability exists in WordPress Randy Peterman Murph StatTraq. An attacke...

PT-2020-2078

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 80.0.3987.149 Description The issue is related to a use after free error in the audio component of Google Chrome, which can be exploited by a remote attacker to potentially access sensitive data, compromise data...

CVE-2019-3762

Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid...

CVE-2020-0813

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data.To exploit the vulnerability, an attacker must know the memory address of where the obje...

Scripting Engine Information Disclosure Vulnerability

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data. To exploit the vulnerability, an attacker must know the memory address of where the objec...

CVE-2019-2999

Vulnerability in the Java SE product of Oracle Java SE component: Javadoc. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

Cyber tips for safe online dating: How to avoid privacy gaffs, exploits, and scams

Research and reporting on this article were conducted by Labs writers Chris Boyd and David Ruiz. Dating apps have been mainstream for a long time now, with nearly every possible dating scene covered—casual, long-term, gay, poly, of the Jewish faith, interested only in farmers—whatever you're...

PT-2020-22888

Уязвимость реализация сервера X Xorg связана с некорректной проверкой uid пользователя. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании...

Microsoft Windows Graphics Component Information Disclosure Vulnerability (CNVD-2020-03539)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Graphics is one of the graphics components. An information disclosure...

PT-2020-22849

Уязвимость системы управления ЕПП службы Astra Linux Directory ALD связана с ошибкой обработки инициализации домена. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании...

PT-2020-6942

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 73 Firefox ESR versions prior to 68.5 Description The issue is related to a buffer overflow, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. A content...

Oracle VM VirtualBox Unauthorized Access Vulnerability

Oracle VM VirtualBox is a cross-platform virtualization software for x86 systems. A security vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 5.2.36, 6.0.16, and 6.1.2. An attacker could exploit the vulnerability to access critical data and compromise...

Oracle Enterprise Manager Ops Center (Oct 2019 CPU)

The version of Oracle Enterprise Manager Ops Center installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component: - An unspecified vulnerability in the Networking cURL component of Oracle Enterprise Manager Ops Center. An easy to exploit...

Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.9.x prior to 11.1.1.9.200114 or 12.2.1.3.x prior to 12.2.1.3.200114 or 12.2.1.4.x prior to 12.2.1.4.200114. It is, therefore, affected by multiple vulnerabilities as noted in the January 2020 Critical Patch...

MySQL 5.6.x < 5.6.47 Multiple Vulnerabilities (Jan 2020 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.47. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the January 2020 Critical Patch Update advisory: - Unspecified vulnerability in the optimizer component o...

CVE-2020-2728

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: OIM - LDAP user and role Synch. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

CVE-2020-2720

Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 12.1.0-12.4.0 and 14.0.0-14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT...