RETRACTED

...

The 2020 Workshop on Economics and Information Security (WEIS)

The workshop on Economics and Information Security is always an interesting conference. This year, it will be online. Heres the program. Registration is free...

CVE-2020-5676

CVE-2020-5676 affects GROWI (WESEEK) v4.1.3 and earlier. It is described as an information-disclosure vulnerability where remote attackers may obtain information not allowed to access via unspecified vectors (CWE-200). The connected NVD/Veracode/Red Hat/JVN records corroborate the entry: informat...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

Healthcare security in 2021

The pandemic has turned 2020 into a year of medicine and information technology. The remarkable surge in the criticality level of medical infrastructure, coupled with feasible across-the-board digitalization, led to many of our last years predictions coming true much sooner than expected. As we...

CVE-2020-6317

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2020-4626

CVE-2020-4626 affects IBM Cloud Pak for Security (CP4S) 1.3.0.1. An authenticated user can cause information disclosure by sending a specially crafted HTTP request, potentially revealing sensitive internal network information. The IBM security bulletin notes the issue and provides a remediation p...

Intelbras Router RF 301K 1.1.2 Authentication Bypass

Exploit Title: Intelbras Router RF 301K 1.1.2 - Authentication Bypass Date: 27/11/2020 Exploit Author: Kaio Amaral Vendor Homepage: https://www.intelbras.com/pt-br/ Software Link: http://backend.intelbras.com/sites/default/files/2020-10/RF301Kv1.1.2.zip Version: firmware version 1.1.2 Tested on:...

CVE-2019-19873

CVE-2019-19873 affects B&R Industrial Automation APROL before R4.2 V7.08. The issue allows an attacker to bypass authentication to retrieve information from the AprolSqlServer DBMS. This is described as a separate vulnerability from CVE-2019-16356 and CVE-2019-9983. Connected sources confirm the ...

Shopify: Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!

Please Note: I found this bug on a website made using Shopify I tried doing the same with my Shopify store but I was not able to buy anything as it was required to add credit card details which I don't have : THE LINKS GIVEN AS THE EXAMPLE ARE NOT VALID LINKS BUT THE BUG WORKS ON EVERY SHOPIFY...

CVE-2020-29130

CVE-2020-29130 is a buffer over-read in libslirp’s SLiRP networking code (through 4.3.1). Several advisories document that slirp.c reads header data beyond the packet length, enabling potential leakage of host information bytes to a privileged guest. Public sources consistently classify the impac...

CVE-2020-26212

Technical details about CVE-2020-26212 (affected GLPI versions, root cause, exploitability) are not present in the provided connected documents. The Initial Description notes the fix in 9.5.3 and a CalDAV workaround, but no further public details are available here. Monitor for updates.

CVE-2020-28331

Barco wePresent WiPG-1600W devices (affected version 2.5.1.8) expose an Improper Access Control vulnerability in the SSH daemon lifecycle. The firmware ships SSH but it is disabled by default; a device configuration variable governs starting the SSH daemon at boot. The web interface lacks a visib...

Manchester United: IT Systems Disrupted in Cyberattack

The Manchester United football club in the U.K. has confirmed that the team fell victim to a cyberattack on its systems. Man U., one of the most popular soccer teams in the world, said that it was suffering ongoing IT disruptions. “The club has taken swift actions to contain the attack and is...

CVE-2020-4771

IBM Spectrum Protect Operations Center contains a vulnerability (CVE-2020-4771) where improper authentication of a websocket endpoint could allow a remote attacker to obtain sensitive information by subscribing to the websocket event stream. Affected versions are IBM Spectrum Protect Operations C...

M/Monit 3.7.4 - Password Disclosure

Title: M/Monit 3.7.4 - Password Disclosure Author: Dolev Farhi Date: 2020-07-09 Vendor Homepage: https://mmonit.com/ Version : 3.7.4 import sys import requests url = 'http://youriphere:8080' username = 'test' password = 'test123' sess = requests.Session sess.gethost def login: print'Attempting to...

CVE-2020-28361

Kamailio (used in SER/Sippy Softswitch) up to version before 5.4.0 is affected by a header-smuggling bypass in the remove_hf function of the Kamailio textops module. The vulnerability can be exploited by a skilled attacker with valid credentials to bypass header-removal protections and disrupt in...

Movable Type Premium vulnerable to cross-site scripting

Overview Movable Type Premium provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning...

CVE-2020-13352

Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: =10.2, =13.4, =13.5, 13.5.2...

CVE-2020-13352

GitLab CVE-2020-13352 affects GitLab CE/EE versions 10.2 through 13.3.8, 13.4 through 13.4.4, and 13.5 through 13.5.1, where private group information is leaked when moving a project from a private to a public group. Root cause: information leakage in group visibility handling during transfers. R...