4557 matches found
[20201101] - Core - com_finder ignores access levels on autosuggest
The autosuggestion feature of comfinder did not respect the access level of the corresponding terms...
How Covid-19 Contact Tracing Works on Your Phone
Developers are working on track-and-trace systems to keep infection levels low. The apps aren't here yet, but here's what they do—and how you can enable them...
Establishing risk appetite is key to effective risk management
The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...
Android Security Bulletin—May 2020Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-05-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
IDOR can reveal execution data and logs to unauthorized user in Rundeck
Impact Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is...
ZSQL: Server Logging Levels
The LOGLEVEL parameter specifies the levels of run logs and debug logs to be written into the server. The default value is 7, indicating that run logs in all levels are written into the server. If LOGLEVEL is set to 0, not only RUN and DEBUG logging, but also ALARM logging will be disabled. This...
CVE-2020-7278 McAfee firewall rules not enforced correctly
Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...
The vulnerability of Xen hypervisors relates to insufficient validation of input data. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of Xen hypervisors relates to the dynamic adaptation of the number of page levels in the IOMMU, in accordance with the size of the address space of the user. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause...
The vulnerability of the fribidi_get_par_embedding_levels_ex() function (lib/fribidi-bidi.c) in the GNU FriBidi library allows a attacker to cause a service failure or execute arbitrary code.
The vulnerability of the fribidigetparembeddinglevelsex function lib/fribidi-bidi.c in the GNU FriBidi library is related to buffer overflow vulnerabilities. Exploiting this vulnerability could allow an attacker to cause a service failure or execute arbitrary code...
Security Bulletin: Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation (CVE-2019-4584)
Summary Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation from an authenticated local user to root. Vulnerability Details CVEID: CVE-2019-4584 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer overflow,...
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation via loading libraries from an untrusted path (CVE-2018-1802).
Summary Db2 binaries load shared libraries from an untrusted path, potentially giving low privileged user root access. Vulnerability Details CVEID: CVE-2018-1802 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server binaries load shared libraries from an untrusted path...
Security Bulletin: Privilege escalation in IBM® Db2® tool db2cacpy (CVE-2018-1685).
Summary A vulnerability exists in db2cacpy which could expose sensitive information to user. Vulnerability Details CVEID: CVE-2018-1685 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server contains a vulnerability in db2cacpy that could allow a local user to read any file ...
How I Avoided a Recruiter Scam
Recruitment scams are a serious, but often overlooked risk to job seekers. Those responsible for these schemes often play on the victim's stress levels or professional ego, by using authority to offer something that could be life changing, often with large salaries. I've personally experienced a...
U.S. Dept Of Defense: [Critical] Insufficient Access Control On Registration Page of Webapps Website Allows Privilege Escalation to Administrator
Summary: Hello. Due to insufficient access controls and poor implementation of the registration at https://████████/████/login.cfm it was possible to register while privilege escalating to an administrator. Description: It was possible to tamper with the registration request at...
fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial of service and possible code execution
A heap-based buffer overflow vulnerability was found in GNU FriBidi, an implementation of the Unicode Bidirectional Algorithm bidi. When the flaw is triggered it's possible to manipulate the heap contents, leading to memory corruption causing a denial of service and to arbitrary code execution. T...
Download: The State of Security Breach Protection 2020 Survey Results
What are the key considerations security decision-makers should take into account when designing their 2020 breach protection? To answer this, we polled 1,536 cybersecurity professionals in The State of Breach Protection 2020 survey Download the full survey here to understand the common practices...
CVE-2019-14907
A flaw was found in samba. When log levels are set at 3 or higher, the string obtained from the client, after a failed character conversion, is printed which could cause long-lived processes to terminate. The highest threat from this vulnerability is to system availability. Mitigation Do not set ...
CVE-2013-3946
Heap-based buffer overflow in the MrSID plugin MrSID.dll before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a levels header...
