The vulnerability of Thunderbolt devices’ microcontrollers, related to errors in the implementation of the SPI Flash interface, allows attackers to gain direct access to the memory of computing devices connected to Thunderbolt interfaces.

The vulnerability of Thunderbolt device microcontrollers is related to errors in the implementation of the SPI Flash interface. Exploiting this vulnerability can allow an attacker to gain direct access to the memory of computing devices, to which Thunderbolt-enabled devices are connected...

ThunderSpy

A combination of vulnerabilities for the Thunderbolt protocol have been announced that allow a malicious actor to access most machines with a Thunderbolt port and bypass security restrictions on the device. Recent assessments: agalauner-r7 at May 11, 2020 4:37pm UTC reported: The risks of DMA...

CVE-2020-9753

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer...

CVE-2020-9753

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer...

Code injection

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer...

CVE-2020-9753

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer...

CVE-2020-9753

CVE-2020-9753 concerns the Naver Whale Browser Installer prior to 1.2.0.5, which does not perform signature verification for the Flash installer. The connected records indicate a trust issue that could enable a forged installer to bypass security checks, with sources including NVD, Red Hat, and C...

CVE-2020-9753

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer...

Naver Whale Browser Installer Data Forgery Issue Vulnerability

Naver Whale Browser is a web browser with a user-defined interface from Naver, Korea.Installer is the installer. A data forgery vulnerability exists in Naver Whale Browser Installer versions prior to 1.2.0.5, which originates from a Flash installer that does not support signature checking. An...

Microsoft Patch Tuesday, May 2020 Edition

Microsoft today issued software updates to plug at least 111 security holes in Windows and Windows-based programs. None of the vulnerabilities were labeled as being publicly exploited or detailed prior to today, but as always if you're running Windows on any of your machines it's time once again ...

Top 10 Routinely Exploited Vulnerabilities

Summary The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, and the broader U.S. Government are providing this technical guidance to advise IT security professionals at public and private sector organizations to place an increased priority on patchi...

Eclair has a logic flaw vulnerability

Eclair is a flash wallet for Android based systems.Eclair to 0.3 allows an attacker to trigger a loss of funds due to incorrect access control. An attacker could use the vulnerability to not pay or underpay the total amount of cash...

HPE Service Pack for ProLiant Code Execution Vulnerability

HPE Service Pack for ProLiant is a comprehensive set of system software and firmware update solutions from Hewlett Packard Enterprise HPE. A security vulnerability exists in the Supplemental Update/Online ROM Flash Component in HPE Service Pack for ProLiant versions 2018.06.0, 2018.09.0, and...

CVE-2020-7135

A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant SPP releases 2018.06.0, 2018.09.0, and...

HPESBHF03945 rev.1 - HPE Servers using Supplemental Update / Online ROM Flash Component for Linux, Local Execution of Arbitrary Code.

Potential Security Impact: Local: Execution of Arbitrary Code With Privilege Elevation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Service Pack for ProLiant 2018.06.0, 2018.09.0, 2018.11.0 - Only applies to Linux firmware installer HPE SATA Read Intensive Solid State Drive...

U.S. Dept Of Defense: CSRF - Modify Company Info

Target Url ███/services/user/manageAccountCompany Summary: Similar to███████, but on different endpoint. The application is missing CSRF Token on Editing company info endpoint. This lead to CSRF attack. Bypassing Content-Type The application is just accepting Content-Type as application/json. Thi...

CVE-2019-20782

An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. LG Advanced Flash LAF has a buffer overflow. The LG ID is LVE-SMP-190001 March 2019...

CVE-2019-20782

CVE-2019-20782 describes a buffer overflow in LG Advanced Flash (LAF) on LG mobile devices running Android 7.x–8.1. The issue is tied to LG’s LAF component and 나타는 root cause is a buffer overflow. Documents specify affected versions and device scope but do not provide exploit details, affected pr...

Google Android f2fs component buffer overflow vulnerability

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA. f2fs is a flash file system component of Android. A buffer overflow vulnerability exists in the f2fs component of Android, which can be exploited by an attacker to obtain information...

Information Disclosure

The kdebase is vulnerable to information disclosure. A problem with the interaction between the Flash Player and the Konqueror web browser was found. The problem could lead to key presses leaking to the Flash Player applet instead of the browser...