PT-2021-8382

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.2.0 Description The issue arises from the standard library in Rust, where the BinaryHeap is not panic-safe. When the comparison of generic elements inside sift up or sift down range panics, the binary heap is left in a...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in the Rust standard library prior to version 1.2.0, which stems from the binary heap being in a failure to agree state when comparing generic elements of sift up or...

FreeBSD : asterisk -- Remote attacker could prematurely tear down SRTP calls (5d8ef725-7228-11eb-8386-001999f8d30b)

The Asterisk project reports : An unauthenticated remote attacker could replay SRTP packets which could cause an Asterisk instance configured without strict RTP validation to tear down calls prematurely. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Livecoin crypto exchange shuts down after losing domain to hackers

By Waqas The decision comes after Livecoin claims its servers were hacked and taken over by attackers in December 2020. This is a post from HackRead.com Read the original post: Livecoin crypto exchange shuts down after losing domain to hackers...

Joker's Stash, The Largest Carding Marketplace, Announces Shutdown

Joker's Stash, the largest dark web marketplace notorious for selling compromised payment card data, has announced plans to shut down its operations on February 15, 2021. In a message board post on a Russian-language underground cybercrime forum, the operator of the site — who goes by the name...

WordPress Advanced Custom Fields plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress Advanced Custom Fields plugin before 5.8.12, which...

Apache Accumulo Access Control Error Vulnerability

Apache Accumulo is a reliable, scalable, high-performance sorted distributed Key-Value storage application from the Apache Foundation. An access control error vulnerability exists in Apache Accumulo versions 1.5.0 through 1.10.0 and 2.0.0 due to an authenticated user failing to properly check the...

CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

CVE-2020-17533 Apache Accumulo Improper Handling of Insufficient Permissions

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

...

Vulnerability Spotlight: Two vulnerabilities in Lantronix XPort EDGE

Kelly Leuschner of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.Executive summary Cisco Talos recently discovered two vulnerabilities in the Web Manager functionality of Lantronix XPort EDGE. The XPort EDGE is a next-generation wired Ethernet gateway for providing secure...

Design/Logic Flaw

Trusted Computing Group TCG Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USEDAUSED. Improper initialization of this shut-down may result in susceptibility to a dictionary atta...

PT-2020-16558

Name of the Vulnerable Software and Affected Versions Trusted Computing Group TCG Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 Description The issue is related to Incorrect Access Control during a non-orderly TPM shut-down that uses USE DA USED...

CVE-2020-26933: Improper Initialization

Trusted Computing Group TCG Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USEDAUSED. Improper initialization of this shut-down may result in susceptibility to a dictionary atta...

Maze Ransomware Operators Shutting Down Their Operations

By Deeba Ahmed In a bizarre announcement, the Maze ransomware gang revealed that their only aim was to reveal the security lapses at their targets. This is a post from HackRead.com Read the original post: Maze Ransomware Operators Shutting Down Their Operations...

UBUNTU-CVE-2020-14383

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again...

VulnCheck KEV: CVE-2008-4873

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...

Headwinds and Tailwinds - Cycling For Climate Awareness in a Global Pandemic

If you told me at the beginning of 2020 that I'd be cycling 250 miles in the remote Upper Peninsula of Michigan, fundraising for an organization called "Climate Ride", and wearing a face mask to go grocery shopping - I would not have believed you. Yet, since March 2020, we've all been living the...

CVE-2020-3643

u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...

CVE-2020-3643: Exposure of Sensitive Information to an Unauthorized Actor

u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...