PT-2020-12451 · Frozennode · Laravel-Administrator

Name of the Vulnerable Software and Affected Versions: FrozenNode Laravel-Administrator versions 5.0.12 and earlier Description: The issue allows unrestricted file upload and consequently Remote Code Execution via the "admin/tips image/image/file upload" API endpoint, where an attacker can upload...

CVE-2019-20608

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

CVE-2019-20604

An issue was discovered on Samsung mobile devices with O8.x software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 May 2019...

CVE-2019-20608

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with O8.x software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 May 2019...

PT-2020-2816 · Videolabs +1 · Libmicrodns +1

Name of the Vulnerable Software and Affected Versions: Videolabs libmicrodns version 0.1.0 Description: An exploitable denial-of-service issue exists in the resource allocation handling of Videolabs libmicrodns. When encountering errors while parsing mDNS messages, some allocated data is not free...

PT-2020-2146 · Videolabs +1 · Libmicrodns +1

Name of the Vulnerable Software and Affected Versions: Videolabs libmicrodns version 0.1.0 Description: The issue is related to a denial-of-service vulnerability in the message-parsing functionality of libmicrodns. It occurs when parsing mDNS messages, as the implementation does not properly trac...

Warning — Two Unpatched Critical 0-Day RCE Flaws Affect All Windows Versions

Microsoft today issued a new security advisory warning billions of Windows users of two new critical, unpatched zero-day vulnerabilities that could let hackers remotely take complete control over targeted computers. According to Microsoft, both unpatched flaws are being used in limited, targeted...

PT-2020-19606 · Igss · Igss

Name of the Vulnerable Software and Affected Versions: IGSS versions 14 and prior Description: A Missing Authentication for Critical Function issue exists, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the...

PT-2020-6978 · Hdf5 +4 · Hdf5 +4

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.12.1 Description: An issue exists in the function H5F get nrefs located in H5Fquery.c, which is related to a NULL pointer dereference. This issue allows an attacker to cause Denial of Service. Recommendations: For...

PT-2020-6977 · Hdf5 +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.12.0 Description: A heap-based buffer overflow exists in the function Decompress located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary, allowing an attacker to cause Denial of...

Security Bulletin: Vulnerability in SSLv3 affects DataPower (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled by default in DataPower. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

wagtail-2fa authorization issue vulnerability

wagtail-2fa is a two-factor authentication software package. An authorization issue vulnerability exists in versions prior to wagtail-2fa 1.4.1, which stems from the program's failure to request specific permissions for the view and delete functions of another user's 2FA device, which can be...

Exploit for CVE-2020-10558

TESLA Denial of Service for All Vehicles | CVE-2020-10558 Tes...

PT-2020-6582

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.9.x Description A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and...

PT-2020-6580

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.9.x Description A flaw was found in the Ansible Engine when the fetch module is used, allowing an attacker to intercept the module, inject a new path, and choose a new destination path on the controller...

Kubernetes: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements

This bug report mostly concerns the default CNI plugins https://github.com/containernetworking/plugins but I believe affects many K8S clusters. Because the CNI team still doesn’t provide an explicit way to report security bugs, I hope the K8S security team doesn’t mind doing the coordination job...

Exploit for CVE-2020-0976

GUI Check CVE-2020-0796 勘误： 正确的CVE名称是CVE-2020-0796，而不是CV...

Odd security letter issued to Microsoft a high-risk vulnerability warning Win10 as the main effect of the target-vulnerability warning-the black bar safety net

Recently, Qi'an letter of Threat Intelligence Center released Microsoft WindowsSMBv3 service remote code execution vulnerability announcements. Notice that 3 on 11 May, the foreign company released a recent Microsoft security patch design vulnerability summary, which includes a threat level is...