Osmand Code Issue Vulnerability

Osmand is a mapping and navigation application for mobile platforms. A code issue vulnerability exists in Osmand 2.0.0 and prior versions. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. No detailed vulnerability detai...

CVE-2020-10245

CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Recent assessments: zeroSteiner at May 07, 2020 9:03pm UTC reported: The following analysis is based on CODESYS 3.5.15.20: Installer file: CODESYS 3.5.15.20.exe, SHA-1...

Consumerization: a better way to answer cybersecurity challenges

A version of this article originally appeared in Forbes on February 12, 2020. Consumerization: The specific impact that consumer-originated technologies can have on enterprises. Gartner More and more, enterprises are coming to understand that they need to adopt the agile processes and product...

Starkiller - A Frontend For PowerShell Empire

Starkiller is a Frontend for Powershell Empire. It is an Electron application written in VueJS. If you'd like to contribute please follow the Contribution guide. Getting Started To run Starkiller, you can download the installers for Mac, Linux, and Windows on the Releases page. For more info on...

Revamped HawkEye Keylogger Swoops in on Coronavirus Fears

There’s a new variant of the HawkEye keylogging malware making the rounds, featuring expanded info-stealing capabilities. Its operators are looking to capture the zeitgeist around the novel coronavirus. It’s being distributed using spam that purports to be an “alert” from the Director-General of...

Aligning Enterprise Cyber Risk and Business Strategy

Most business leaders have a contextual awareness of cyber risk and the threats facing their organizations. However, this contextual awareness rarely contributes to a clear, consolidated directive that can be applied across the organizations. Further, many organizations struggle to align their...

TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks

A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol RDP connection exposed to the Internet. The module, dubbed...

DigitalOcean: Unauthorized access to https://shipit.analogpond.com/

Summary: Unauthorized access to https://shipit.analogpond.com/digitalocean/marketplace/production/ with ability to rollback deploys just like digitalocean developers. Steps To Reproduce: I was doing recon when I came accross marketplace-fra1.digitalocean.com with CNAME...

GitLab Code Issue Vulnerability (CNVD-2020-19601)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A code issue vulnerability exists in GitLab Enterprise...

The Basics of Exploit Development 2: SEH Overflows

In this article we will be writing an exploit for a 32-bit Windows application vulnerable to Structured Exception Handler SEH overflows. While this type of exploit has been around for a long time, it is still applicable to modern systems...

Unauthorized Access Vulnerability in Kodak Video Surveillance Devices

hereinafter referred to as KODAK is a provider of video and security products and solutions, dedicated to video conferencing, video surveillance and a wealth of video application solutions to help all kinds of government and enterprise customers to solve the visual communication and management...

CVE-2019-20509

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none...

UBUNTU-CVE-2019-20509

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none...

CVE-2019-20509

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none...

CVE-2019-20509

CVE-2019-20509 was withdrawn by the CNA and is not an active vulnerability entry; connected advisories indicate the issue affected only a development version. Public details tie the fix to libarchive (archive_read_support_format_lha.c) with updates to version 3.4.3 (e.g., Mageia MGASA-2020-0253; ...

Fedora 31 : sudo (2020-8b563bc5f4)

update to latest development version 1.9.0b1 - added sudologsrvd and sudosendlog to files and their appropriate man pages Resolves: rhbz1787823 - Stack based buffer overflow in when pwfeedback is enabled Resolves: rhbz1796945 - fixes: CVE-2019-18634 - By using ! character in the shadow file...

File Upload Vulnerability in eFrameWork

eFrameWork is a development framework for B/S application and web development. A file upload vulnerability exists in eFrameWork, which can be exploited by an attacker to gain control of the web server...

CVE-2019-3696

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise...

HPESBST03983 rev.1 - HPE Command View Advanced Edition (CVAE), Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP XP7 CVAE Earlier than 8.7.1-00 HPE XP7 Command View Advanced Edition Suite Earlier than 8.7.1-00 CVSS Scores: | CVE | CVSS Vector | Base...

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 10.19.0. Security Fixes: nodejs: HTTP request smuggling using malformed...