17647 matches found
CVE-2020-11190
creationtimestamp| type| source ---|---|--- 2021-03-17 11:30:43+00:00| seen| https://t.me/cibsecurity/24986 2026-01-20 08:04:53+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...
CVE-2020-11221
CVE-2020-11221 describes a local information-disclosure vulnerability in Qualcomm/ Snapdragon components where a non-secure entity can exploit insufficient checks in the syscall handler to extract secure QTEE diagnostic information in clear text. Affected families include Snapdragon Auto, Compute...
CVE-2021-28294
creationtimestamp| type| source ---|---|--- 2021-03-16 23:30:17+00:00| seen| https://t.me/cibsecurity/24978...
Finding the Cracks in the Wall - The Hazard of Single Authentication Factor
The use of authentication factors, one of the most fundamental and well understood concepts in information security, enables secure access to applications, services, and networks. It can affect an enterprise's security posture, however, as the drastic increase in data breaches and system attacks...
Code injection
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
CVE-2021-20283
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
CVE-2021-20283
CVE-2021-20283 affects Moodle versions prior to 3.10.2, 3.9.5, 3.8.8, and 3.5.17. The vulnerability is an Insecure Direct Object Reference (IDOR) where the web service that fetches other users’ enrolled courses did not verify that the requesting user has permission to view that information for ea...
CVE-2021-20281
CVE-2021-20281 affects Moodle and concerns information disclosure of other users’ full names via the “online users” block. The root cause is an information disclosure vulnerability present in Moodle versions listed as vulnerable prior to 3.10.2, 3.9.5, 3.8.8, and 3.5.17. Impact is exposure of ful...
CVE-2020-25240
CVE-2020-25240 affects SINEMA Remote Connect Server (all versions
CVE-2021-23357
CVE-2021-23357 - Normal mode (concrete details available) Affected software: github.com/TykTechnologies/tyk/gateway (Tyk Gateway) with the vulnerability reported across multiple feeds. Vulnerability and root cause: Directory Traversal via the handleAddOrUpdateApi function. The APIID supplied by t...
Hikvision Integrated Video and Environmental Monitoring Management System Exploits Arbitrary File Download Vulnerability
Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. An arbitrary file download vulnerability exists in Hikvision's integrated video and environmental surveillance management system, which can be exploited by attackers to obtain...
Weak password vulnerability in TL-WR845N
The TL-WR845N is a router from P&L Technologies. The TL-WR845N suffers from a weak password vulnerability that can be exploited by an attacker to obtain sensitive information...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking at the Australian Cyber Conference 2021 on March 17 and 18, 2021. I’m keynoting the all-virtual RSA Conference 2021, May 17-20, 2021. I’ll be speaking at an Informa event on September 14, 2021. Details to come. The lis...
CVE-2020-35682
creationtimestamp| type| source ---|---|--- 2021-03-13 22:26:49+00:00| seen| https://t.me/cibsecurity/24884...
Prototype Pollution in automattic/cli-table
Description Prototype Pollution in cli-table Proof of Concept 1. Create the following PoC file: // poc.js var cliTable = require"cli-table" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted; cliTablepayload; console.log"After : " +...
GHSA-XHFX-HGMF-V6VP October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
Impact When running on servers that are configured to accept a wildcard as a hostname i.e. the server routes any request, regardless of the HOST header to an October CMS instance the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on...
CVE-2020-35232
This CVE-2020-35232 entry is rejected/not used and does not represent an active vulnerability entry.
Information disclosure
In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...