CVE-2020-11081

osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables...

Credit-Card Skimmer Has Unlikely Target: Microsoft ASP.NET Sites

Researchers have identified a credit-card skimming campaign that’s been active since mid-April that has a rather specific and unusual target: ASP.NET-based websites running on Microsoft Internet Information Services IIS servers. New research from Malwarebytes Labs recently uncovered the campaign,...

CVE-2020-9100

Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing...

CVE-2020-9100: Uncontrolled Search Path Element

Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing...

Python code issue vulnerability (CNVD-2020-53314)

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A code issue vulnerability exists in Python Windows that stems from python3X.dll using an invalid search...

Huawei P30 Data Forgery Issue Vulnerability

Huawei P30 is a smartphone from Chinese company Huawei Huawei. A security vulnerability exists in previous versions of Huawei P30 10.1.0.135 C00E135R2P11, which stems from the program failing to properly verify the signature of a specific software package. An attacker can exploit the vulnerabilit...

PT-2020-10066

Name of the Vulnerable Software and Affected Versions CyMiInstaller322 ActiveX affected versions not specified Description A vulnerability in the CyMiInstaller322 ActiveX component, which is used by MIPLATFORM to download files required for application execution, allows an attacker to download...

apache-commons-configuration: uncontrolled class instantiation when loading YAML files

A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default...

DEBIAN-CVE-2020-14939

An issue was discovered in savestructinternal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

CVE-2020-14416

A use-after-free flaw was found in slcanwritewakeup in drivers/net/can/slcan.c in the serial CAN module slcan. A race condition occurs when communicating with can using slcan between the write scheduling the transmit and closing flushing out any pending queues the SLCAN channel. This flaw allows ...

CVE-2019-20867

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

CVE-2019-20867

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

Code injection

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

CVE-2019-20867

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

CVE-2019-20867

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

PT-2020-10830

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.11.0 Description An issue allows an attacker to interfere with a channel's post loading via one crafted post. Recommendations For versions prior to 5.11.0, update to version 5.11.0 or later to resolve the...

CVE-2019-20867: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

Important: zsh

Issue Overview: In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls setuid...

Microsoft SharePoint Unrestricted File Execution

The vulnerability of the Microsoft SharePoint software package relates to the unlimited loading of files of a malicious nature. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of the SharePoint application pool and the SharePoint server account...