17647 matches found
CVE-2020-29482
CVE-2020-29482 affects Xen up to 4.14.x via oxenstored. A guest can create xenstore paths in its own namespace that exceed the pathname limit, because management tools must use absolute paths and oxenstored enforces a limit on the client-specified path. This can cause some management tools and de...
CVE-2020-29480
Xen CVE-2020-29480 affects Xen up to 4.14.x. Xenstore watches lack permission checks, enabling a guest administrator to observe root xenstore notifications for all created, modified, and deleted keys and domain lifecycle events. The watch data may reveal counts/identities of other VMs, domains, d...
CVE-2020-0480
CVE-2020-0480 affects Android 11 in the Framework: DocumentsProvider.java allows a local escalation of privilege due to a missing permission check in callUnchecked. The issue enables a caller to copy, move, or delete files accessible to DocumentsProvider without extra execution privileges. Exploi...
CVE-2020-0368
Summary of CVE-2020-0368 (Android) Affects Android 11 where the issue lies in the CallLogProvider.java function queryInternal . The root cause is improper input validation, enabling a local permission bypass that could disclose voicemail metadata. Exploitation requires User privileges but not use...
CVE-2020-29395
creationtimestamp| type| source ---|---|--- 2020-12-15 14:02:02+00:00| published-proof-of-concept| https://t.me/cKure/3262...
CVE-2020-28861
CVE-2020-28861 affects OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier. The vulnerability is an access control flaw on the /Stream/ProjectsCSV endpoint that allows unauthenticated attackers to retrieve potentially sensitive project data. Connected sources indicate vulnerable versions...
New Windows Trojan Steals Browser Credentials, Outlook Files
Researchers have discovered a new information-stealing trojan, which targets Microsoft Windows systems with an onslaught of data-exfiltration capabilities– from collecting browser credentials to targeting Outlook files. The trojan, called PyMicropsia due to it being built with Python has been...
U.S. Dept Of Defense: PII Information Leak at https://████████.mil/
Summary: While making use of some recon techniques I came across this file which is leaking PII information publically on the Internet. In the description section, I explain the contents of the file and why it shouldn't be public like this. Description: The file in the POC section contains more...
CVE-2020-26415
CVE-2020-26415: Information about starred projects for private user profiles was exposed via GitLab's GraphQL API starting from 12.2 via REST. Affected products/versions include GitLab 12.2–13.4.7, 13.5–13.5.5, and 13.6–13.6.2. The connected documents do not provide explicit fix versions or remed...
CVE-2020-9301
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container...
CVE-2020-25967
creationtimestamp| type| source ---|---|--- 2020-12-11 02:34:40+00:00| seen| https://t.me/cibsecurity/19645 2020-12-11 02:37:46+00:00| seen| https://t.me/cibsecurity/19665 2020-12-11 03:25:37+00:00| seen| https://t.me/cibsecurity/19685 2020-12-11 04:25:29+00:00| seen| https://t.me/cibsecurity/197...
CVE-2020-9301
CVE-2020-9301 affects Spinnaker before v1.23.4, v1.22.4, and v1.21.5. The issue involves handling of SpEL expressions allowing an authenticated attacker to read and write arbitrary files inside the orca container via HTTP POST requests. Affected component: Spinnaker container/orca handling of SpE...
CVE-2020-9301
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container...
COVID-19 Vaccine Cyberattacks Steal Credentials, Spread Zebrocy Malware
Cybercriminals are tapping into the impending rollout of COVID-19 vaccines with everything from simple phishing scams all the way up to sophisticated Zebrocy malware campaigns. Security researchers with KnowBe4 said that the recent slew of vaccine-related cyberattacks leverage the widespread medi...
CVE-2020-26832
The CVE-2020-26832 issue affects SAP AS ABAP (SAP Landscape Transformation) and SAP S4 HANA (Landscape Transformation) with vulnerable versions: ABAP 2011_1_620/640/700/710/730/731/752 and S4 HANA 101–105. Root cause: missing authorization allows a high-privilege user to execute an RFC function m...
CVE-2020-26966
CVE-2020-26966 affects Mozilla Firefox (Windows only) and Thunderbird; the issue arises from a memory leak via broadcasting of single-word search queries as mDNS requests on the local network. Affected products include Firefox before version 83, Firefox ESR before 78.5, and Thunderbird before 78....
omniauth-apple allows attacker to fake their email address during authentication
Impact This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other...