Code injection

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users...

Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.5. It is, therefore, affected by a vulnerability. - An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the...

CVE-2020-9526

Technical details about CVE-2020-9526 are not publicly available in the provided documents. Monitor for updates from vendors and vulnerability databases.

CVE-2020-9526

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising...

Information disclosure

HUAWEI P30 smart phones with versions earlier than 10.1.0.160C00E160R2P11 have an information exposure vulnerability. The system does not properly authenticate the application that access a specified interface. Attackers can trick users into installing malicious software to exploit this...

CVE-2014-8938

Lexiglot (up to 2014-11-20) is affected by an information-disclosure vulnerability where local users can obtain usernames and passwords by listing a process, due to credentials being exposed on the command line. Root cause: credentials present on the command line. Impact is a local confidentialit...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Information disclosure

An information exposure vulnerability exists in gitlab.com v12.3.2, v12.2.6, and v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted...

CVE-2019-1010299

The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vecdeque::Iter. The attack...

CVE-2019-4299

IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765...

CVE-2019-13075

Summary: CVE-2019-13075 affects Tor Browser up to v8.5.3, exposing the browser language. Affected software: Tor Browser (based on Firefox) prior to version 68 behavior. Root cause / vector: An information exposure via an IFRAME, where the language text is embedded in the title attribute of a LINK...

Information disclosure

Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting...

CVE-2019-12383

Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting...

CVE-2017-5210

Open-Xchange OX App Suite 7.8.3 and earlier are affected by an Information Exposure vulnerability (CVE-2017-5210). Affected product: Open-Xchange OX App Suite; version 7.8.3 and earlier. Root cause not explicitly detailed in the provided documents beyond information disclosure. Impact: unauthoriz...

CVE-2018-1999028

An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins...

CVE-2018-12926

Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...

Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple php vulnerabilities

Summary Multiple security vulnerabilities have been discovered in php that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-8835 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Tivoli Storage Manager FastBack

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Tivoli Storage Manager FastBack. IBM Tivoli Storage Manager FastBack has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive...

Security Bulletin: Security vulnerabilities have been identified in DB2 which is shipped with IBM Performance Management products

Summary DB2 is shipped with IBM Performance Management products. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins. Vulnerability Details CVEID: CVE-2017-1520 DESCRIPTION: IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorize...

January 24, 2018 – Morning Cyber Coffee Headlines – “Taco” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 24, 2018 - Headlines Carbon Black in the News: Amazon Web Services Buys...