CVE-2020-25204: Undefined Security Weakness

The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver. The purpose of this broadcast receiver is to show an in-game push notification to the player. However, the...

Foxit Studio Photo NEF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

PT-2020-16714

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.3 Description The issue is related to the lack of LibreOffice sandboxing, which could allow remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With access to the API...

Cybersecurity Visuals

The Hewlett Foundation just announced its top five ideas in its Cybersecurity Visuals Challenge. The problem Hewlett is trying to solve is the dearth of good visuals for cybersecurity. A Google Images Search demonstrates the problem: locks, fingerprints, hands on laptops, scary looking hackers in...

PT-2020-4595

Name of the Vulnerable Software and Affected Versions Marketo Sales Insight plugin version 1.4355 and earlier Description The issue is related to a blind stored Cross-Site Scripting XSS vulnerability. This could allow an attacker to inject malicious scripts into vulnerable form fields. When a...

Apache Solr Remote Code Execution Vulnerability (CNVD-2020-57571)

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. Apache Solr suffers from a remote code execution vulnerability that...

Microsoft Outlook HTML Email Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Outlook. User interaction is required to exploit this vulnerability in that the target must open a malicious email or view it in the preview pane. The specific flaw exists within the parsin...

PT-2020-5810

Name of the Vulnerable Software and Affected Versions: x11vnc version 0.9.16 Description: The issue is related to the scan.c component of the X11vnc VNC server, which lacks an authorization mechanism. This allows a remote attacker to access confidential data, compromise its integrity, and cause a...

CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0...

in microweber/microweber

Description microweber/microweber is vulnerable to Arbitrary File Upload. Effective controls have not been implemented to restrict users from uploading malicious content to the web server. Files containing code like .php, .exe and etc can be uploaded successfully. Steps To Reproduce-: 1. Login in...

The vulnerability in the web interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web interface for controlling the Cisco Data Center Network Manager DCNM system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected informatio...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-17413

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-26911: Undefined Security Weakness

Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 befor...

PT-2020-16553

Name of the Vulnerable Software and Affected Versions NETGEAR D6200 versions 1.1.00.37 and earlier NETGEAR D7000 versions 1.0.1.77 and earlier NETGEAR JR6150 versions 1.0.1.23 and earlier NETGEAR R6020 versions 1.0.0.41 and earlier NETGEAR R6050 versions 1.0.1.23 and earlier NETGEAR R6080 version...

CVE-2020-26919

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Healthcare security update: death by ransomware, what’s next?

A recent ransomware attack which played a significant role in the death of a German woman has put into focus both the dangers and the importance of cybersecurity today. But it has also led some to point fingers as to who was responsible. As usual, playing the blame game helps no one, but it does...

(0Day) Realtek rtl81xx SDK Wi-Fi Driver rtwlane Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Realtek rtl81xx SDK Wi-Fi driver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of 802.11 frames. The issue results from the...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of protective measures for the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 resource planning software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using specially crafted requests...

PT-2020-20271

Name of the Vulnerable Software and Affected Versions ALEOS versions 4.11 and later Description The issue is related to a lack of input sanitization in the UpdateRebootMgr service, allowing an escalation to root from a low-privilege process. Recommendations For ALEOS versions 4.11 and later, at t...