Windows GDI Information Disclosure

The vulnerability of the Windows GDI component of the Windows operating system is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially crafted application...

Apache Tomcat Jserv Protocol Code Execution

The vulnerability of the Apache Jserv Protocol – the server for Apache Tomcat applications – is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Windows Cryptography Next Generation Disclosure

The vulnerability of the Windows Cryptography Next Generation CNG service on Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

XSS vulnerability in Subversion Release Manager

Subversion Release Manager 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure...

Huawei USG6330 DoS

The vulnerability of the Huawei USG6330 network firewall is related to errors in processing network packets. Exploiting this vulnerability can allow a remote attacker to exhaust the available memory and cause the device to reboot...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

Format string

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

CVE-2020-10101

CVE-2020-10101 affects Zammad 3.0–3.2 where the WebSocket server crashes when non‑JSON messages are sent. The root cause is inadequate validation of message format and unhandled parsing errors, causing a service process crash. Public details in the connected sources reiterate the same description...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

SAP NetWeaver Keystore Disclosure

The vulnerability of the SAP NetWeaver software integration platform’s keystore service is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Keycloak STARTTLS Privilege Escalation

The vulnerability of the STARTTLS component of the Keycloak identity and access management software is related to implementation errors in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

Keycloak Privilege Escalation

The vulnerability of the Keycloak identity and access management software is related to errors in the implementation of authentication procedures. Exploiting this vulnerability can allow unauthorized actors to gain increased privileges...

Intel NVMe Intel RSTe Privilege Escalation

The vulnerability of Intel NVMe and Intel RSTe driver installers is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges...

SynTP.sys Driver Unauthorized Access

The vulnerability of the SynTP.sys driver for Synaptics Touchpads is related to errors in handling API requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

SharePoint Workflows XOML Injection

This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality. Module Options msf use exploit/windows/http/sharepoint/workflowsxoml msf...

OPENSUSE-SU-2020:0261-1 Security update for python-azure-agent

This update for python-azure-agent fixes the following issues: python-azure-agent was updated to version 2.2.45 jscECO-80 + Add support for Gen2 VM resource disks + Use alternate systemd detection + Fix /proc/net/route requirement that causes errors on FreeBSD + Add cloud-init auto-detect to...

Kr00k WiFi Vulnerability

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...

Windows Cryptography Next Generation Disclosure

The vulnerability of the Windows Cryptography Next Generation CNG service on Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

Windows Function Discovery Privilege Escalation

The vulnerability of the Windows Function Discovery service in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially created application...