SUSE SLES11 Security Update : xen (SUSE-SU-2020:14557-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14557-1 advisory. - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing...

Command Execution Vulnerability in dubbo 2.7.12

dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...

Command execution vulnerability in dubbo 2.7.12 (CNVD-2021-44686)

dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...

DarkSide Pwned Colonial With Old VPN Password

It took only one dusty, no-longer-used password for the DarkSide cybercriminals to breach the network of Colonial Pipeline Co. last month, resulting in a ransomware attack that caused significant disruption and remains under investigation by the U.S. government and cybersecurity experts. Attacker...

SUSE: Security Advisory (SUSE-SU-2018:3456-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-18264

Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=acteditmember"...

CVE-2021-31153

please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...

CVE-2021-31153

please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...

KLA12192 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, execute arbitrary code, cause denial of service, obtain sensitive information, gain privileges. Below is a complete list of...

About the security content of iOS 14.6 and iPadOS 14.6

About the security content of iOS 14.6 and iPadOS 14.6 This document describes the security content of iOS 14.6 and iPadOS 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Command Execution Vulnerability in Amami Digital Hotel's Broadband Operations System

Ammed Century Beijing Technology Co., Ltd. is a digital service solution provider and digital content operation service provider for star-rated hotels. A command execution vulnerability exists in Ammed's digital hotel broadband operation system. An attacker can exploit this vulnerability to gain...

Vulnerabilities fixed in QEMU and libvirt

Vulnerabilities have been fixed in QEMU and libvirt. The vulnerabilities allow a local, authenticated malicious person potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Access to system data Increased user privileges -= Red Hat =- Red Hat...

The vulnerability of the Server component of the Oracle Secure Global Desktop software allows a perpetrator to gain full control over the application or execute arbitrary code.

The vulnerability of the Server component of the Oracle Secure Global Desktop software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application or execute arbitrary code using the SKID protoco...

CVE-2020-18964

Cross Site Request Forgery CSRF Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges...

DarkSide Wanted Money, Not Disruption from Colonial Pipeline Attack

Threat actors behind last week’s Colonial Pipeline ransomware attack that crippled a major U.S. oil pipeline said that financial gain–not political, economic or social disruption–is the goal of their nefarious activities, vowing to choose their targets more carefully in the future. Join Threatpos...

CVE-2021-31154

pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack...

CVE-2021-31153

please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...

The vulnerability of the SCADA system of OIK Dispetchner NT, related to deficiencies in the cryptographic algorithms used, allows a intruder to retrieve user data and increase privileges within the system.

The vulnerability of the SCADA system of OIK Dispatching Network is related to deficiencies in the cryptographic algorithms used. Exploiting this vulnerability could allow an intruder to retrieve user data and increase privileges within the system...

Design/Logic Flaw

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3...

CVE-2020-22789

Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs...