CVE-2020-5016

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to vi...

CVE-2021-22863

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker woul...

Lazarus Targets Defense Companies with ThreatNeedle Malware

The prolific North Korean APT known as Lazarus is behind a spear-phishing campaign aimed at stealing critical data from defense companies by leveraging an advanced malware called ThreatNeedle, new research has revealed. The elaborate and ongoing cyberespionage campaign used emails with COVID-19...

CVE-2020-35565

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default...

CVE-2020-35565

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default...

CVE-2021-27139

An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

Code injection

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

CVE-2021-26921 affects Argo CD before 1.8.4, from the util/session/sessionmanager.go code. The root issue allows tokens to remain valid after the associated user account is disabled, enabling continued token authentication despite deactivation. The impact is described across multiple sources (e.g...

Authentication Bypass

mautic/core is vulnerable to authentication bypass. An OAuth2 auth plugin added for API access is able to allow a disabled user to still login using email address...

GHSA-6X98-FX9J-7C78 Disabled users able to log in with third party SSO plugin

Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Patches Upgrade to 2.12.0 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at [email protected]...

Disabled users able to log in with third party SSO plugin

Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Patches Upgrade to 2.12.0 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at [email protected]...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.53.1 - Fonts: Support FONTEXTRAWORDS macros for built-in fonts Peilin Ye Orabug: 32176267 - fbdev, newportcon: Move FONTEXTRAWORDS macros into linux/font.h Peilin Ye Orabug: 32176267 CVE-2020-28915 - vt: Disable KDFONTOPCOPY Daniel Vetter Orabug: 32187751 CVE-2020-28974...

WhatsApp Will Disable Your Account If You Don't Agree Sharing Data With Facebook

"Respect for your privacy is coded into our DNA," opens WhatsApp's privacy policy. "Since we started WhatsApp, we've aspired to build our Services with a set of strong privacy principles in mind." But come February 8, 2021, this opening statement will no longer find a place in the policy. The...

Linux: Disabled talk server

The talk software makes it possible for users to send and receive messages across systems through a terminal session. The talk client allows initiate of talk sessions is installed by default. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

Linux: Disabled telnet server

The telnet-server package contains the telnet daemon, which accepts connections from users from other systems via the telnet protocol. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Unspecified Vulnerability in Phoenix Contact mGuard Devices

Phoenix Contact Mguard is a firewall device for industrial environments from Phoenix Contac. The device features multiple protection modes, deep packet inspection, malware and virus detection. A security vulnerability exists in Phoenix Contact mGuard Devices, which stems from the fact that for...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:3867-1)

This update for webkit2gtk3 fixes the following issues : -webkit2gtk3 was updated to version 2.30.3 bsc1179122 bsc1179451 : - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code...