3168 matches found
Code injection
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely...
PT-2020-5576 · Sophos · Sophos Sfos +1
Name of the Vulnerable Software and Affected Versions: Sophos XG Firewall versions 17.0, 17.1, 17.5 Sophos XG Firewall versions 18.0 through 2020-04-25 Description: A SQL injection vulnerability exists in Sophos XG Firewall, allowing for potential remote code execution and data exfiltration. The...
CVE-2020-12271: Sophos XG Firewall Pre-Auth SQL Injection Vulnerability
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration HTTPS service or the User Portal exposed on the WAN zone. A successful attack...
Ansible: kubectl connection plugin leaks sensitive information
A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw...
Hacker returns $25 million after their IP address is exposed
By Sudais Asif In a shocking twist of events, the entire sum has been returned back by the hacker. Here's what happened and how. This is a post from HackRead.com Read the original post: Hacker returns $25 million after their IP address is exposed...
QRadar Community Edition 7.3.1.6 Cross Site Scripting
------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page ------------------------------------------------------------------------ Yorick Koster, September 2019...
NETGEAR RAX40 Information Disclosure Vulnerability
The NETGEAR RAX40 is a wireless router from NETGEAR. An information disclosure vulnerability exists in versions prior to NETGEAR RAX40 1.0.3.64, which can be exploited by attackers to obtain sensitive information...
VulnCheck KEV: CVE-2019-19755
ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...
Web exhibition PHP foreign trade enterprise website red style front SQL injection vulnerability
Netzhan Technology Beijing Century Netzhan Technology Co., Ltd. is an Internet service operator specializing in the field of exhibition shows. SQL injection vulnerability exists in the red style frontend of Nethub's PHP foreign trade enterprise website, which can be exploited by attackers to obta...
TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks
A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol RDP connection exposed to the Internet. The module, dubbed "rdpScanDl...
DEBIAN-CVE-2020-1740
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and t...
UBUNTU-CVE-2020-1753
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...
Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...
MGASA-2020-0142 Updated thunderbird packages fix security vulnerabilities
The updated packages fix a security vulnerabilities: Out of bounds reads in sctploadaddressesfrominit. CVE-2019-20503 Use-after-free when removing data about origins. CVE-2020-6805 BodyStream::OnInputStreamReady was missing protections against state confusion. CVE-2020-6806 Use-after-free in cube...
CVE-2019-18576
Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...
CVE-2019-13205
All configuration parameters of certain Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 were accessible by unauthenticated users. This information was only presented in the menus when authenticated, and the pages that loaded this information were also protected. However, all files th...
Siemens SiNVR 3 Plain Text Save File Vulnerability
SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 stores login credentials in plain text in a log file. An information disclosure vulnerability exists in the implementation, which can be exploited by a...
