CVE-2020-6243

The CVE-2020-6243 entry affects SAP Adaptive Server Enterprise (XP Server on Windows), specifically versions 15.7 and 16.0. The root cause is that the extended stored procedure execution may not perform necessary checks for an authenticated user, allowing an attacker to read, modify, or delete re...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

yattag.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1158981 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Zoho ManageEngine DataSecurity Plus DataEngine Xnode Server Application Path Traversal Vulnerability

Zoho ManageEngine DataSecurity Plus is a sensitive data management solution from Zoho USA. The product features data leakage prevention, data risk assessment and file server auditing. A path traversal vulnerability exists in the Zoho ManageEngine DataSecurity Plus DataEngine Xnode Server...

Hackers Exploit Critical Flaw in Ghost Platform with Cryptojacking Attack

Hackers targeted the publishing platform Ghost over the weekend, launching a cryptojacking attack against its servers that led to widespread outages. The attack stemmed from the exploit of critical vulnerabilities in SaltStack, used in Ghost’s server management infrastructure. Ghost is a free,...

CVE-2019-4288

IBM Maximo Anywhere versions 7.6.2.x and 7.6.3.x are affected by CVE-2019-4288, an information disclosure where an attacker with physical access and authenticated to the device could copy application information via Android Backup. The vulnerability is caused by the product’s handling of backups,...

The Covid-19 Pandemic Reveals Ransomware's Long Game

Hackers laid the groundwork months ago for attacks. Now they're flipping the switch...

Code injection

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects OTRS Community Edition: 5.0.42 and prior versions, 6.0.27 and prio...

CVE-2020-5869

CONTEXT: CVE-2020-5869 affects F5 BIG-IQ HA synchronization. Affected software: BIG-IQ 5.2.0–7.0.0. ROOT CAUSE: TLS protection for HA sync is not secure, enabling potential on-path interception or tampering of confidential data in transit. IMPACT: confidentiality and integrity of BIG-IQ HA data m...

actioncurrency.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1149319 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Improper access control

Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data marked as restricted, such as viewing or editing user profiles and application settings...

NFL Tackles Cybersecurity Concerns Ahead of 2020 Draft Day

The NFL draft is slated to start Thursday, and thanks to the COVID-19 pandemic, it will be the first virtual version of the event ever presented. This raises a few cybersecurity concerns, according to researchers and the teams themselves — but the NFL is planning on knocking the security ball...

Folder Lock 3.4.5 Cross Site Scripting

Document Title: =============== Folder Lock v3.4.5 iOS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2210 Release Date: ============= 2020-04-20 Vulnerability Laboratory ID VL-ID: ==================================== 221...

bejoradio.fm Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1147397 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bejoradio.fm website and...

Unspecified Vulnerability in Oracle Retail Applications Retail Customer Management and Segmentation Foundation

Oracle Retail Applications is a set of retail applications store solutions from Oracle Corporation Oracle. The product includes inventory management, sales management and customer management, etc. Retail Customer Management and Segmentation Foundation is one of the retail customer management...

Foxit PhantomPDF U3DBrowser U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-7483

CVE-2020-7483 affects legacy Schneider Electric TriStation 1131 software (TriStation 1131 v1.0.0–4.9.0, v4.10.0 and 4.12.0) where the optional password feature can cause certain data to be transmitted in cleartext over the network. Schneider Electric remediated this by releasing TriStation v4.9.1...

CVE-2020-2815

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite component: Profile. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks requi...

CVE-2020-2760

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Zoom Taps Ex-Facebook CISO Amid Security Snafus, Lawsuit

As it faces a major lawsuit, Zoom is taking a significant step to bolster security and privacy efforts by recruiting an industry heavy-hitter – former Facebook CISO Alex Stamos – to provide special counsel. It has also named third-party expert security advisory teams. The popular videoconferencin...