CVE-2020-8024 Problematic permissions in hylafax+ packaging allow escalation from uucp to other users

A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to...

CVE-2020-8024

CVE-2020-8024 describes an Incorrect Default Permissions issue in the packaging of hylafax+ for openSUSE Leap 15.1, Leap 15.2, and Factory. The root cause is incorrect default permissions in the hylafax+ packaging, enabling local attackers with user uucp to escalate privileges to the hylafax bina...

GHSA-MC6H-4QGP-37QH Deserialization of untrusted data in Jackson Databind

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...

DEBIAN-CVE-2020-14195

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...

UBUNTU-CVE-2020-14195

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...

EAP: XXE issue in TransformerFactory

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...

CVE-2019-19412

Huawei smart phones have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products...

CVE-2019-19412

Huawei smart phones have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products...

Security feature bypass

Huawei smart phones have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products...

CVE-2019-19412

Huawei smart phones have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products...

This Week in Security News: Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode and TrickBot Adds Enterprise-grade Module to Malware Arsenal

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about a new module for the infamous trojan known as TrickBot that has been deployed. Also, read about Google’s $5 billion class-action...

jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

Design/Logic Flaw

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

This Week in Security News: How Researchers Used an App Store to Demonstrate Hacks on a Factory and Microsoft Again Surpasses 100 Vulnerabilities on Patch Tuesday

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about how researchers at Trend Micro used an app store to demonstrate hacks on a manufacturing facility. Also, learn about this month’s...

CVE-2020-0091

In mnld, an incorrect configuration in drivercfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAndroid ID: A-149808700...

CVE-2020-0091

In mnld, an incorrect configuration in drivercfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAndroid ID: A-149808700...

CVE-2020-0091

CVE-2020-0091 affects the MediaTek mnld component; description in the initial docs notes an incorrect configuration in driver_cfg of mnld for meta factory mode. The entry is listed under Android/Microsoft 2020-05 release details as a High severity issue for the MediaTek mnld in the 2020-05-01 sec...