CVE-2020-25890

The web application of Kyocera printer ECOSYS M2640IDW is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address Book". Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the...

Kyocera ECOSYS M2640IDW Cross-Site Scripting Vulnerability

The Kyocera ECOSYS M2640IDW is a multifunction printer from Kyocera, Japan. A cross-site scripting vulnerability exists in Kyocera printer ECOSYS M2640IDW, which was discovered when adding a contact to Machine Address Book. Successful exploitation of this vulnerability could result in the hijacki...

Bugs in Critical Infrastructure Gear Allow Sophisticated Cyberattacks

Two security vulnerabilities in Schneider Electric’s programmable logic controllers PLCs could allow attackers to compromise a PLC and move on to more sophisticated critical infrastructure attacks. PLCs are key pieces of equipment in environments such as electric utilities and factories. They...

Uncovered: APT 'Hackers For Hire' Target Financial, Entertainment Firms

A hackers-for-hire operation has been discovered using a strain of previously undocumented malware to target South Asian financial institutions and global entertainment companies. Dubbed "CostaRicto" by Blackberry researchers, the campaign appears to be the handiwork of APT mercenaries who posses...

Imperva SD-SOC: How Using AI and Time Series Traffic Improves DDoS Mitigation

Much has changed since we first started providing protection against DDoS attacks. Attacks which were once considered huge are now mitigated on a daily basis, attackers are becoming more sophisticated by the day, and mitigation takes a matter of seconds, as opposed to minutes, to kick in. But one...

Scalper-Bots Shake Down Desperate PS5, Xbox Series X Shoppers

It’s a big week for gamers across the globe, with imminent, dueling releases of Xbox Series X and PlayStation PS5. However, an army of retail bots threaten to drive prices up as much as three times the retail price, putting the coveted holiday gifts well out of reach of everyday fans. Retailers...

PT-2020-6348

Name of the Vulnerable Software and Affected Versions Modicon M221 all versions Modicon M100 affected versions not specified Modicon M200 affected versions not specified Description A CWE-326: Inadequate Encryption Strength issue exists that could allow an attacker to break the encryption key whe...

Citrix UPM Log Parser

Citrix UPM Log Parser v1.5 Created Date: Oct 8, 2009 Modified Date: Oct 4, 2016 Please note: You can download the required file from the Citrix downloads website by visiting the following link:https://www.citrix.com/downloads/citrix-tools Description Citrix UPM Log Parser has been designed to hel...

DEBIAN-CVE-2020-27617

ethgetgsotype in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol...

Veeam ONE creates or changes local accounts of the "Veeam_*" format at the Veeam ONE server machine

Challenge Veeam ONE creates or changes local accounts of the "Veeam" format on the Veeam ONE server machine. Cause This behavior is a part of the Veeam ONE design. Veeam ONE creates these temporary Windows accounts for login and authentication operations between Veeam ONE components and VMware...

Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid

An out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulti...

EulerOS 2.0 SP9 : dpdk (EulerOS-SA-2020-2428)

According to the versions of the dpdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer...

UBUNTU-CVE-2020-25650

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service f...

UBUNTU-CVE-2020-25651

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The...

EulerOS 2.0 SP9 : dpdk (EulerOS-SA-2020-2410)

According to the versions of the dpdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer...

The vulnerability of the Java VM component of the Oracle Database Server database management system allows attackers to compromise the integrity of the protected information.

The vulnerability of the Java VM component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

The vulnerabilities in the VMCI drivers of VMware ESXi, VMware Workstation, and VMware Fusion allow attackers to cause system failures.

The vulnerability of VMCI drivers in hypervisor graphics of VMware ESXi, VMware Workstation, and VMware Fusion is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a attacker to cause service failures...

EulerOS 2.0 SP8 : dpdk (EulerOS-SA-2020-2308)

According to the versions of the dpdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being...

[SECURITY] [DLA 2420-2] linux regression update

Debian LTS Advisory DLA-2420-2 [email protected] https://www.debian.org/lts/security/ Ben Hutchings October 31, 2020 https://wiki.debian.org/LTS Package : linux Version : 4.9.240-2 CVE ID : CVE-2019-9445 CVE-2019-19073 CVE-2019-19074 CVE-2019-19448 CVE-2020-12351 CVE-2020-12352...

Nethive-Project - Restructured And Collaborated SIEM And CVSS Infrastructure

The Nethive Project provides a Security Information and Event Management SIEM insfrastructure empowered by CVSS automatic measurements. Features Machine Learning powered SQL Injection Detection Server-side XSS Detection based on Chrome's XSS Auditor Post-exploitation Detection powered by Auditbea...