17647 matches found
CVE-2020-8400
CVE-2020-8400 entry is rejected/not used; does not represent an active vulnerability per initial description.
CVE-2020-8381
CVE-2020-8381 entry is rejected/not used and does not represent an active vulnerability.
CVE-2021-0435
CVE-2021-0435 describes a heap data leak in the Android Bluetooth stack: in avrc_proc_vendor_command within avrc_api.cc, uninitialized data can leak heap data, enabling remote information disclosure with no extra privileges and without user interaction. Affected Android versions include Android-1...
GHSA-3PCR-4982-548M Exposure of .env if project root is configured as web root in shopware/production
Impact The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root. Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview...
New Book! The Best of TaoSecurity Blog, Volume 4
I've completed the TaoSecurity Blog book series. The new book is The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship. It's available now for Kindle, and I'm working on the print edition. I'm running a 50% off promo on Volumes 1-3 on Kindle through...
Hacking Operational Technology for Defense: Lessons Learned From OT Red Teaming Smart Meter Control Infrastructure
High-profile security incidents in the past decade have brought increased scrutiny to cyber security for operational technology OT. However, there is a continued perception across critical infrastructure organizations that OT networks are isolated from public networks—such as the Internet. In...
Weak Password Vulnerability in WR1045ND of P&L Technologies Ltd.
"TP-LINK" is a leading global supplier of network communication equipment. A weak password vulnerability exists in TP-LINK WR1045ND, which can be exploited by attackers to log in to the system backend and obtain sensitive information...
PYSEC-2021-147
in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive...
A flaw was found in Nettle in versions before 3.7.2 where several Nettle signature verification functions (GOST DSA EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality integrity as well as system availability.
...
CVE-2021-20020
CVE-2021-20020 affects SonicWall Global Management System (GMS) 9.3 . The vulnerability is described as a remote, unauthenticated command execution that leads to local privilege escalation to root on the appliance. Connected sources corroborate a high-severity, network-exposed issue with root-lev...