9176 matches found
GHSA-Q4CQ-539C-3MMM Directory Traversal in serveryztyzt
Affected versions of serveryztyzt resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Examp...
GHSA-C3HR-WWH3-QM54 Directory Traversal in fsk-server
Affected versions of fsk-server resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...
JITSploitation I: A JIT Bug
By Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS...
[SECURITY] Fedora 32 Update: univocity-parsers-2.8.4-5.fc32
uniVocity-parsers is a suite of extremely fast and reliable parsers for Java. It provides a consistent interface for handling different file formats, and a solid framework for the development of new parsers...
[SECURITY] Fedora 32 Update: eclipse-cdt-9.11.1-8.fc32
Eclipse features and plugins that are useful for C and C++ development...
[SECURITY] Fedora 32 Update: eclipse-4.16-11.fc32
The Eclipse platform is designed for building integrated development environments IDEs, server-side applications, desktop applications, and everything in between...
Revamped Qbot Trojan Packs New Punch: Hijacks Email Threads
Attacks attributed to the Qbot trojan, known as the “Swiss Army knife” of malware, are on the uptick with a reported 100,000 recent infections, according to researchers. Qbot, an ever-evolving information-stealing trojan that’s been around since 2008, has shifted tactics again and adopted a bevy ...
The command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools exposes clients to vulnerabilities, allowing attackers to exploit these privileges.
The vulnerability of the command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools relates to improper external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to gain increased...
Get Lifetime Access to 1000+ Premium Online Training Courses for Just $59
"In today's knowledge economy, continual learning is an imperative." — Those words from Aytekin Tank, the founder of JotForm, are particularly important for anyone working in IT or development. With over 1,000 premium courses complete list from top instructors, StackSkills Unlimited provides...
WECON LeviStudioU (Update C)
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU --------- Begin Update C Part 1 of 3 --------- Vulnerabilities: Stack-based Buffer Overflow, Improper Restriction of XML External Entity Reference, Heap-based...
Shopify: Password protection can be removed for newly created development store
Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-storesthe-development-store-password-page, it states that the password can only be removed once the store has been transferred or switch to a paid plan. You can remove the password page only after you transfer...
Achieving Product Platform mindset
Imperva has decided to gradually shift to a company-wide Platform mindset in which, instead of having a set of separate products and features, there is a set of capabilities and building blocks upon which the products and features are built. Until now, special Platform teams have developed Platfo...
Shopify: Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020)
Hi, Description I have found a way to bypass the password page of a shopify preview URL for new development stores created as of August 17, 2020. Currenty, with older development stores, when we share a preview url with someone, we are able to see the content of the store without having to enter ...
Lua Code Problems Vulnerabilities
Lua is a lightweight, extensible open source scripting language from the Lua team. A code issue vulnerability exists in the ldebug.c file in Lua version 5.4.0. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. No detaile...
[SECURITY] Fedora 32 Update: nss-3.55.0-1.fc32
Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...
[SECURITY] Fedora 32 Update: qt-4.8.7-55.fc32
Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling...
The vulnerability of the `vhost_user_set_log_base` function in libraries and drivers for fast packet processing in DPDK allows attackers to access sensitive data, compromise its integrity, and cause service failures.
The vulnerability of the vhostusersetlogbase function in libraries and drivers for fast packet processing in DPDK lies in a potential integer overflow. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and even cause service failures...
Partnering with Microsoft on Hackathon 2020 and Saving the Planet
During the week of July 27, thousands of participants from around the globe participated in the Microsoft 2020 Hackathon. In its seventh year -- and this year, fully virtual -- the annual worldwide event brings Microsoft employees and interns together to drum up new ideas, create change, and make...
CVE-2020-6932
CVE-2020-6932 affects BlackBerry QNX Software Development Platform (SDP) 6.4.0–6.6.0, specifically the slinger web server. The root cause is a directory traversal and remote code execution flaw in the slinger component that could allow an attacker to read arbitrary files and execute arbitrary cod...