1941 matches found
Low: Red Hat Security Advisory: CloudForms 4.7.7 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link...
bubblewrap: temporary directory misuse as mount point
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations related to XDGRUNTIMEDIR, a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code...
U.S. Dept Of Defense: [███████] Reflected GET XSS (/mission.php?...&missionDate=*)
I will combine this vulnerability with this vulnerability described in this report 648222. If you have not read this report, I recommend reading that report first, and then studying this report. I want to note that this report cannot be closed as a duplicate to the above described report. why?...
CVE-2019-13272
In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a...
A week in security (July 8 – 14)
Last week on Malwarebytes Labs, we looked at ways to send your sensitive information in a secure fashion, examined some tactics in incident response land, and explored federal data privacy law. We also looked at how security tools can turn against you, and took a deep dive into the rather fiendis...
Cross-Site Scripting (XSS)
firefox is vulnerable to cross-site scripting XSS. When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary...
Mailvelope Encryption Problem Vulnerability
Mailvelope is a suite of open source extensions for using in-browsers. The program is primarily used for end-to-end encryption of email traffic within a web browser. A cryptographic issue vulnerability exists in Mailvelope versions prior to 3.3.0, which arises from a network system or product tha...
CVE-2019-13177
verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...
Improper Verification of Cryptographic Signature in django-rest-registration
Misusing the Django Signer API leads to predictable signatures used in verification emails Impact The vulnerability is a high severity one. Anyone using Django REST Registration library versions 0.2. - 0.4. with e-mail verification option which is recommended, but needs additional configuration i...
TP-Link TL-WR1043ND Encryption Issue Vulnerability
The TP-Link TL-WR1043ND is a wireless router from China P&L TP-Link. An encryption issue vulnerability exists in the TP-Link TL-WR1043ND V2. The vulnerability stems from a network system or product that does not properly use the relevant cryptographic algorithms, and can be exploited by an attack...
Linux kernel memory misreference vulnerability (CNVD-2019-38524)
The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A fixedmdiobusinit memory misreference vulnerability exists in Linux kernel versions prior to 5.0. The vulnerability...
Moxa AWK-3121 Encryption Issues Vulnerability
Moxa AWK-3121 is an industrial-grade wireless access point from Moxa Taiwan, China. An encryption issue vulnerability exists in Moxa AWK-3121 version 1.14. The vulnerability stems from the network system or product not properly using the relevant cryptographic algorithms, resulting in content not...
Verizon’s DBIR Highlights Key Drivers of Security Risk
It’s that time of the year when Verizon updates us on the latest trends in the global threat landscape with its Data Breach Investigations Report DBIR. The findings in this year’s report are based on data provided by more than 70 sources including Qualys about more than 41,000 security incidents,...
The Different Ways a Data Breach Can Impact Businesses
By Ryan De Souza According to a recent report from the Office for National Statistics ONS, cybercrime has risen by an incredible 63% and is primarily caused by malware and computer misuse. However, despite the real threat hackers pose to companies of all sizes, many businesses are failing to take...
CVE-2019-3894
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security...
Vulnerability of the Server component: Security: Privileges of the MySQL database management system, which allows a hacker to cause a service failure.
The vulnerability of the Server component: Security: Privileges of the MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
Facebook May Face $5 Billion FTC Fine for Data Misuse
UPDATE Facebook may be facing fines as high as $5 billion after a year-long Federal Trade Commission FTC investigation into its data-security practices. Though it wasn’t mentioned in its earnings call on Wednesday, the social-media giant in a release for its Q1 2019 earnings said that it was...
CVE-2019-11426
An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...
US Congress proposes comprehensive federal data privacy legislation—finally
The United States might be the only country of its size—both in economy and population—to lack a comprehensive data privacy law protecting its citizens’ online lives. That could change this year. Never-ending cybersecurity breaches, recently-enacted international privacy laws, public outrage, and...
