8869 matches found
Cross site scripting
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS in the web front end by leveraging the ability to create a custom field with a crafted field name...
Clario: No rate Limit on Licenses Activation
Introduction A little bit about Rate Limit A rate-limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time-frame, HTTP-Servers can respond with status code 429...
Heybbs micro-community suffers from SQL injection vulnerability (CNVD-2020-45134)
Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs Micro Community has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
Netgear Router Vulnerabilities
Multiple Netgear router models contain vulnerabilities that a remote attacker can exploit to take control of an affected device. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to update to the most recent firmware version and to replace end-of-life...
PT-2020-3435 · Palo Alto Networks · Prisma Access +5
Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS versions prior to 9.1.3 Palo Alto Networks PAN-OS versions prior to 9.0.9 Palo Alto Networks PAN-OS versions prior to 8.1.15 Palo Alto Networks PAN-OS 8.0 EOL Description: When Security Assertion Markup Language SAML...
IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2020-34982)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A SQL injection...
IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2020-34981)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A SQL injection...
CVE-2019-4650
IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170961...
New Bill Targeting ‘Warrant-Proof’ Encryption Draws Ire
Privacy advocates are decrying a new bill, which would force tech companies to unlock encrypted devices if ordered to do so by law enforcement with a court issued warrant. The Lawful Access to Encrypted Data Act was introduced on Tuesday by Senate Judiciary Committee Chairman Lindsey Graham R-SC,...
libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...
libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...
CVE-2017-9107
An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with , and adnsqfquoteokquery was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart...
CVE-2020-3263 Cisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution Vulnerability
A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vulnerability is due to improper validation of input that is supplied to application URLs. The attacker could exploit this vulnerability by...
June 18, 2020—KB4567516 (OS Build 15063.2411)
None None...
June 18, 2020—KB4567517 (OS Build 14393.3755)
None None...
June 18, 2020—KB4567515 (OS Build 16299.1937)
None None...
Zoom Reverses Course and Promises End-to-End Encryption for All Users
The videoconferencing platform had previously said that only paid accounts would get the feature—a move privacy advocates roundly decried...
Zoom Will Be End-to-End Encrypted for All Users
Zoom is doing the right thing: it's making end-to-end encryption available to all users, paid and unpaid. This is a change; I wrote about the initial decision here. ...we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our...
CVE-2020-13637
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clientkey, the deviceid, and the public key for end-to-end encryption in cleartext, enabling an attacker by copying or having access to the local storage databas...
Code injection
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clientkey, the deviceid, and the public key for end-to-end encryption in cleartext, enabling an attacker by copying or having access to the local storage databas...