CVE-2020-15949

Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover...

binutils: denial of service via crafted ELF file

findabstractinstance in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service infinite recursion and application crash via a crafted ELF file...

CVE-2020-3514

CVE-2020-3514 describes a Cisco Firepower Threat Defense (FTD) Software multi-instance container escape. An authenticated, local attacker with valid device credentials could modify a startup container configuration file to escape the container and execute commands with root privileges in the host...

CVE-2020-3514 Cisco Firepower Threat Defense Software Multi-Instance Container Escape Vulnerability

A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. The attacker must have valid credentials ...

CVE-2020-3514 Cisco Firepower Threat Defense Software Multi-Instance Container Escape Vulnerability

A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. The attacker must have valid credentials ...

Cisco Firepower Threat Defense Software Multi-Instance Container Escape Vulnerability

A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. The attacker must have valid credentials ...

Taken - Takeover AWS Ips And Have A Working POC For Subdomain Takeover

Takeover AWS ips and have a working POC for Subdomain Takeover. Idea is simple Get subdomains. Do reverse lookups to only save AWS ips. Restart EC2 instance every min. and public ip gets rotated on each restart. Match it with your existing list of subdomain ips and you have a working subdomain...

CVE-2020-15157 containerd can be coerced into leaking credentials during image pull

In containerd an industry-standard container runtime before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer otherwise known as a “foreign...

CVE-2020-15157

In containerd an industry-standard container runtime before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer otherwise known as a “foreign...

CVE-2020-4778

IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156...

CVE-2020-4778

IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156...

CVE-2017-15906

creationtimestamp| type| source ---|---|--- 2020-10-09 15:58:22+00:00| seen| MISP/babf4434-8d64-443a-82c2-48f271a78fec 2024-07-01 14:30:24+00:00| seen| Telegram/2G0LL9YDDO0dQKSo5p4zQWAL-pbipATIxiBPSKqKsYKP6RG0 2024-07-01 14:33:02+00:00| seen| Telegram/w0w9iKcyXi70OnNrtP96yLy6sw-7f3qLcDmBnN0l3Dtxq...

Server-side Request Forgery (SSRF)

phantomjs-seo is vulnerable to server-side request forgery SSRF. An attacker is able to submit requests on behalf of the PhantomJS instance...

PYSEC-2020-158

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of...

kernel: use-after-free in sound/core/timer.c

A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...

kernel: use-after-free in sound/core/timer.c

A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...

Potential DoS with NumberFilter conversion to integer values.

Impact Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Patches Version 2.4.0+ applies a MaxValueValidator with a a default limitvalue of...

HTTP Request Smuggling

squid3 is vulnerable to HTTP request smuggling. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlled content ...

CVE-2020-0287

creationtimestamp| type| source ---|---|--- 2020-09-18 00:55:14+00:00| seen| https://t.me/cibsecurity/14748...

Security update for docker-distribution (moderate)

openSUSE Security Update: Security update for docker-distribution Announcement ID: openSUSE-SU-2020:1433-1 Rating: moderate References: 1033172 1049850 Cross-References: CVE-2017-11468 Affected Products: openSUSE Backports SLE-15-SP2 An update that solves one vulnerability and has one errata is n...