Exploit for Deserialization of Untrusted Data in Oracle Access_Manager

This is a Java class file, specifically the Main class from the com.axin package. The class has a single method, main, which takes an array of String arguments. The method is not implemented, as it is empty. The class has several annotations and attributes, including: LineNumberTable: This...

Prototype Pollution

deep-get-set is vulnerable to prototype pollution. The vulnerability exists as the main function does not restrict proto, constructor and prototype headers to be set in objects...

Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...

CVE-2020-8108

Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80...

QEMU: seccomp: blacklist is not applied to all threads

qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service guest crash by leveraging mishandling of the seccomp policy for threads other than the main thread...

NewStart CGSL MAIN 6.01 : zziplib Vulnerability (NS-SA-2020-0034)

The remote NewStart CGSL host, running version MAIN 6.01, has zziplib packages installed that are affected by a vulnerability: - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. dot dot in a zip file, because of the function unzzipcat in...

NewStart CGSL MAIN 6.01 : gnutls Vulnerability (NS-SA-2020-0033)

The remote NewStart CGSL host, running version MAIN 6.01, has gnutls packages installed that are affected by a vulnerability: - GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 2018-07-16 because of an error in a 2017-10-06 commit. The DTLS...

NewStart CGSL MAIN 6.01 : unbound Multiple Vulnerabilities (NS-SA-2020-0037)

The remote NewStart CGSL host, running version MAIN 6.01, has unbound packages installed that are affected by multiple vulnerabilities: - Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This...

NewStart CGSL MAIN 6.01 : kernel Multiple Vulnerabilities (NS-SA-2020-0030)

The remote NewStart CGSL host, running version MAIN 6.01, has kernel packages installed that are affected by multiple vulnerabilities: - A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS...

NewStart CGSL MAIN 6.01 : python-pip Multiple Vulnerabilities (NS-SA-2020-0035)

The remote NewStart CGSL host, running version MAIN 6.01, has python-pip packages installed that are affected by multiple vulnerabilities: - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA...

NewStart CGSL MAIN 6.01 : tigervnc Multiple Vulnerabilities (NS-SA-2020-0032)

The remote NewStart CGSL host, running version MAIN 6.01, has tigervnc packages installed that are affected by multiple vulnerabilities: - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding...

NewStart CGSL MAIN 6.01 : pcp Multiple Vulnerabilities (NS-SA-2020-0032)

The remote NewStart CGSL host, running version MAIN 6.01, has pcp packages installed that are affected by multiple vulnerabilities: - libpcp in Performance Co-Pilot PCP before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via 1 a PDU with the...

NewStart CGSL MAIN 6.01 : sqlite Multiple Vulnerabilities (NS-SA-2020-0031)

The remote NewStart CGSL host, running version MAIN 6.01, has sqlite packages installed that are affected by multiple vulnerabilities: - SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode function when handling invalid rtree tables. CVE-2019-8457 -...

NewStart CGSL MAIN 6.01 : libreswan Vulnerability (NS-SA-2020-0035)

The remote NewStart CGSL host, running version MAIN 6.01, has libreswan packages installed that are affected by a vulnerability: - An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to...

Authorization Bypass

electron is vulnerable to authorization bypass. The vulnerability exists through a possible context isolation bypass, allowing Electronapplications using the "contextIsolation" code, running in the main world context in the renderer to reach into the isolated Electron context and perform privileg...

Authorization Bypass

electron is vulnerable to authorization bypass. The vulnerability exists as it was possible to bypass a context isolation via leaked cross-context objects, causing code in the main world context to reach the isolated context with higher privileges...

Cross-site Scripting (XSS)

tileserver-gl is vulnerable to cross-site scripting XSS. The vulnerability exists because the key GET parameter is not escaped properly, allowing an attacker to inject malicious script and get it executed when a user visits the application's main page...

Trojans, Backdoors and Droppers: The Most-Analyzed Malware

Trojans, backdoors and droppers, oh my: These are the top three malware types being analyzed by threat intelligence teams, according to statistics out on Thursday. According to anonymized statistics from requests to the Kaspersky Threat Intelligence Portal, almost three quarters 72 percent of the...

CVE-2020-0157

In nfahciconncback of nfahcimain.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure via compromised device firmware with System execution privileges needed. User interaction is not needed for exploitation.Product:...

Unable to add Nutanix AHV cluster due to empty credentials list

Challenge When trying to add a new Nutanix AHV cluster to the Veeam Backup & Replication infrastructure, the operation cannot be finished due to an empty list of credentials. Newly added credentials are not displayed in the Credentials list, and the wizard does not allow adding a new cluster...