5173 matches found
Input validation
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues...
CVE-2019-12433
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues...
CVE-2019-12433
Removed by vendor...
Microsoft Exchange Server Flaw Exploited in APT Attacks
Multiple threat groups are actively exploiting a vulnerability in Microsoft Exchange servers, researchers warn. If left unpatched, the flaw allows authenticated attackers to execute code remotely with system privileges. The vulnerability in question CVE-2020-0688 exists in the control panel of...
Microsoft Exchange Server Flaw Exploited in APT Attacks
Multiple threat groups are actively exploiting a vulnerability in Microsoft Exchange servers, researchers warn. If left unpatched, the flaw allows authenticated attackers to execute code remotely with system privileges. The vulnerability in question CVE-2020-0688 exists in the control panel of...
Patrick Wardle: Apple Devices Hit With Recycled macOS Malware
SAN FRANCISCO – Advanced persistent threat APT groups are hitting Apple devices with malware that has been reverse engineered and redeployed for malicious acts. This technique is complicating attribution efforts, Patrick Wardle, security researcher with Jamf, said this week during RSA Conference...
[SECURITY] Fedora 30 Update: systemd-241-14.git18dd3fb.fc30
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...
Fedora: Security Advisory for systemd (FEDORA-2020-f8e267d6d0)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
GHSA-CMCX-XHR8-3W9P Denial of Service in uap-core when processing crafted User-Agent strings
Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-core to gt;=...
M-Trends 2020: Insights From the Front Lines
Today we release M-Trends 2020, the 11th edition of our popular annual FireEye Mandiant report. This latest M-Trends contains all of the statistics, trends, case studies and hardening recommendations that readers have come to expect through the years—and more. One of the most exciting takeaways...
Linux: Unique primary groups for user accounts
The password file stores information about users such like username, UID, GID, etc. Users with same group can access and unintentionally or maliciously modify another user Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyrig...
Linux: Read /etc/group (KB)
The /etc/group file is a text file that defines the groups on the system. There is one entry per line, with the following format: - groupname:password:GID:userlist Note: This script only stores information for other Policy Controls. Copyright C 2020 Greenbone Networks GmbH Some text descriptions...
CVE-2013-4228
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
Spoofing
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
CVE-2013-4228
CVE-2013-4228 affects the Drupal contributed module Organic Groups (OG) for 7.x-2.x prior to 7.x-2.3. The vulnerability arises from the OG access/visibility fields not properly restricting access to private groups, allowing remote authenticated users to guess node IDs, subscribe to, and read cont...
CVE-2013-4228
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
CVE-2013-4228
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide
A new report published by cybersecurity researchers has unveiled evidence of Iranian state-sponsored hackers targeting dozens of companies and organizations in Israel and around the world over the past three years. Dubbed "Fox Kitten ," the cyber-espionage campaign is said to have been directed a...
CVE-2013-4228: Incorrect Authorization
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
PT-2020-7487
Name of the Vulnerable Software and Affected Versions: Organic Groups OG module versions 7.x-2.x before 7.x-2.3 for Drupal Description: The issue allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors, due to the...