5530 matches found
About the security content of Safari 13.1.1
About the security content of Safari 13.1.1 This document describes the security content of Safari 13.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
About the security content of iCloud for Windows 11.2
About the security content of iCloud for Windows 11.2 This document describes the security content of iCloud for Windows 11.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
About the security content of iCloud for Windows 7.19
About the security content of iCloud for Windows 7.19 This document describes the security content of iCloud for Windows 7.19. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
About the security content of tvOS 13.4.5
About the security content of tvOS 13.4.5 This document describes the security content of tvOS 13.4.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Testing ModSecurity for false positives by books texts
The main things that prevent enabling security solutions like WAF/RASP/IDS/IPS in a blocking mode are false positives. Probably the second one is their inline performance and additional latency, but still. As a cloud-native WAF vendor, we at Wallarm are actively checking our products for false...
CVE-2020-12747
An issue was discovered on Samsung mobile devices with Q10.0 Exynos980 9630 and Exynos990 9830 chipsets software. The Bootloader has a heap-based buffer overflow because of the mishandling of specific commands. The Samsung IDs are SVE-2020-16981, SVE-2020-16991 May 2020...
Linux/x64 Anti-Debug Trick INT3 Trap Shellcode (113 bytes)
113 bytes small Linux/x64 anti-debug trick INT3 trap with execve"/bin/sh" shellcode that is NULL free. / Shellcode Title: linux/x64 anti-debug trick INT3 trap + execve"/bin/sh" - NULL Free - 113 bytes Shellcode Author: Dario Castrogiovanni Tested on: LXLE Linux 18.04 x64 Description: This shellco...
Unauthorized Postings And Removals
keycloak-services is vulnerable to unauthorized postings and removals. Posting different credential IDs can be done by using the remove devices form, subsequently possibly to perform unauthorized removal of MFA devices of other users...
CVE-2020-10686
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users...
CVE-2020-8791
The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary...
CVE-2020-8791
The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary...
Glassdoor: Get all personal email IDs of Glassdoor users[No user interaction required]
Thanks @safehacker2715 for reporting this finding to us and for your great work with a PoC. Keep up the good work and looking forward to more findings from you. Glassdoor sent me an email asking me to upload my resume on Job portal. This email provided a direct link to the upload screen...
PT-2021-7351
Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 4.2.0 Description The issue is related to an out-of-bounds heap buffer access in the ARM Generic Interrupt Controller emulator of QEMU. This occurs because the interrupt ID written to the controller memory are...
Access to all question drafts in private spaces via API
h3. Issue Summary Questions leak information through private space https://asecurityteam.atlassian.net/browse/BOUNTY-2559 h3. Steps to Reproduce Access to questions in spaces is limited to those users that have access to the space. However, question drafts in a restricted space can be accessed by...
CVE-2016-11058
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...
CVE-2016-11058
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...
Hardcoded credentials
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...
CVE-2016-11058
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...
CVE-2016-11058
The CVE-2016-11058 entry concerns the NETGEAR genie Android app prior to version 2.4.34, which mishandles hard-coded API keys and session IDs. This could enable unauthorized access or session hijacking due to exposed credentials, as reflected by the CVSS scores (2.0/3.1) indicating network-exposu...
CVE-2020-12270
React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it...