17644 matches found
CVE-2021-35301
CVE-2021-35301 affects Zammad 1.0.x up to 4.0.0 and is an incorrect access control vulnerability that allows remote attackers to obtain sensitive information via the Ticket Article detail view. Publicly cited sources reiterate the issue but do not publish specific technical details (e.g., vulnera...
CVE-2021-29751
IBM Business Automation Workflow 18.0, 19.0, 20.0 and IBM Business Process Manager 8.5, 8.6 are affected by an access control error that could allow an authenticated user to obtain sensitive information about another user in non-default configurations. Root cause described across connected source...
CVE-2021-3556
CVE-2021-3556 is withdrawn/duplicate of CVE-2021-3559. Connected records describe the underlying issue in libvirt: in virConnectListAllNodeDevices API before 7.0.0, an unprivileged, read-only client can crash the libvirt daemon by executing nodedev-list. This affects hosts with a PCI device/drive...
Unauthorized Access Vulnerability in RICOH Aficio Series Printers at Ricoh (China) Investment Co.
Ricoh China Investment Co., Ltd. provides services and solutions such as document output management services and IT solutions such as office image processing equipment e.g., MFPs, printers, etc., production digital printers, and more. An unauthorized access vulnerability exists in the RICOH Afici...
#LetsTalkSecurity: Adapt or Die
Let's Talk Security: Season 02 // Episode 02: Host, Rik Ferguson, interviews Forrester Analyst, Allie Mellen. Together they discuss to adapt or die...
CVE-2021-20579
CVE-2021-20579 affects IBM Db2 for Linux, UNIX and Windows (Db2 LUW) and Db2 Connect Server, across versions 9.7, 10.1, 10.5, 11.1, and 11.5. The vulnerability arises when a user who can create a view or inline SQL function can expose sensitive information if AUTO_REVAL is set to DEFFERED_FORCE. ...
The 10 must-attend sessions at Black Hat 2021
The 10 must-attend sessions at Black Hat 2021...
Red Teaming. Practice what you preach
We carry out plenty of Red Teaming for customers. As a CBEST, STAR-FS and GBEST accredited supplier, our Red Team work with many large regulated organisations every day of the week. We frequently remind our clients how a simulated attack can be one of the best ways to assess prevention, detection...
Beers with Talos, Ep. #106: Is more than executive action in order?
Beers with Talos BWT Podcast episode No. 106 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded May 20, 2021. Craig wins... This is only the...
Unauthorized Access Vulnerability in CLX-9252 at Samsung (China) Investment Co.
Samsung China Investment Co., Ltd. is the headquarters of Samsung Group in China. By the end of 2008, 20 out of more than 30 companies under Samsung have invested in China, including Samsung Electronics, Samsung SDI, Samsung SDS and Samsung Electro-Mechanics. An unauthorized access vulnerability...
GHSA-QQ3J-XP49-J73F Plugin archive directory traversal in Helm
The Helm core maintainers have identified an information disclosure vulnerability in Helm 3.0.0-3.2.3. Impact A traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and...
Control character injection in console output in github.com/ipfs/go-ipfs
Impact Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. Patches - Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0 For more information If you have any questions...
Weak password vulnerability in OLYM Reporter of Shenzhen Aolian Information Security Technology Co.
hereinafter referred to as "AOLINK" is a comprehensive cryptographic security enterprise integrating algorithm development, product research and development, solution realization, standard formulation and forward-looking technology research, and possessing the international leading comprehensive...
CVE-2010-3300
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks...
CVE-2021-0572
CVE-2021-0572 affects Android 11 with a vulnerability in AccountManagerService.doNotification where an unsafe PendingIntent allows a local permission bypass and potential local information disclosure. Exploitation requires no user interaction and privileges are potentially low with local access. ...