Exploit for Out-of-bounds Write in Adobe Acrobat

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bu...

Security Bulletin: Clickjacking vulnerability identified in IBM Dependency Based Build server web UI

Summary A clickjacking vulnerability has been identified in the IBM Dependency Based Build server web UI. Vulnerability Details Third Party Entry: PSIRT-ADV0022407 DESCRIPTION: Created from Advisory: ADV0022407 CVSS Base score: 5.4 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affecte...

Babuk Ransomware

ARCHIVED STORY Babuk Ransomware By Alexandre Mundo · February 23, 2021 Executive Summary Babuk ransomware is a new ransomware threat discovered in 2021 that has impacted at least five big enterprises, with one already paying the criminals $85,000 after negotiations. As with other variants, this...

OPENSUSE-SU-2021:0316-1 Security update for tor

This update for tor fixes the following issues: tor was updated to 0.4.5.6: https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html Introduce a new MetricsPort HTTP interface Support IPv6 in the torrc Address option Add event-tracing library support for USDT and LTTng-UST Tr...

MGASA-2021-0086 Updated mediawiki packages fix security vulnerability

In MediaWiki before 1.31.11, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. The right colu...

389-ds-base: information disclosure during the binding of a DN

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database...

CVE-2021-26959

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21299. Reason: This candidate is a duplicate of CVE-2021-21299. Notes: All CVE users should reference CVE-2021-21299 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

UBUNTU-CVE-2019-17582

A use-after-free in the zipdirentread function of zipdirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."...

CVE-2020-7782 Command Injection

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

Qualcomm WLAN HOST Resource Management Error Vulnerability

Qualcomm WLAN HOST is a Qualcomm Incorporated USA wireless LAN component used in Qualcomm products. A resource management error vulnerability exists in the Qualcomm WLAN HOST, which arises from the possibility that an entry in the hash table could be deleted before a frame is placed in the PE que...

Number withdrawn

This CVE number has been withdrawn...

CVE-2020-5457

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

Exploit for CVE-2020-1034

This is a PoC Proof of Concept exploit for CVE-2020-1034, a vulnerability discovered by Microsoft and fixed on August 9, 2020. The exploit targets an unpatched Windows 10 2004, build 19041.488. The exploit code is written in C++ and uses the Windows API to manipulate the system's Event Tracing fo...

Security Bulletin: A Weak Authentication vulnerability affect IBM Rational Performance Tester

Summary IBM Rational Performance Tester uses basic authentication wihch is relatively weak. An attacker could potentially decode the encoded credentials. Vulnerability Details Third Party Entry: PSIRT-ADV0027320 DESCRIPTION: Created from Advisory: ADV0027320 CVSS Base score: 5.9 CVSS Vector:...

CVE-2020-9143

creationtimestamp| type| source ---|---|--- 2021-01-14 00:48:53+00:00| seen| https://t.me/cibsecurity/22116...

CVE-2021-1683

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the...

CVE-2021-1684

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the...

CVE-2020-6704

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

CVE-2021-1683

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the...

PT-2021-1955 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in authorization within the Bluetooth service of Windows operating systems. Exploitation of this issue may allow an attacker to elevate their privileges and...