CVE-2020-1858

Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability...

CVE-2020-1858

Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability...

CVE-2020-9028

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...

Cuckoo Clock v5.0 - Buffer Overflow

Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow Exploit Author: boku Date: 2020-02-14 Vendor Homepage: https://en.softonic.com/author/pxcompany Software Link: https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download Version: 5.0 Tested On: Windows 10 32-bit Recreate: 1...

CVE-2020-9007

Codoforum 4.8.8 allows self-XSS via the title of a new topic...

CVE-2020-9007

Codoforum 4.8.8 allows self-XSS via the title of a new topic...

Design/Logic Flaw

Codoforum 4.8.8 allows self-XSS via the title of a new topic...

CVE-2020-9007

CVE-2020-9007 affects Codoforum 4.8.8. The issue is a self-XSS vulnerability in the title of a new topic, stemming from insufficient validation of client-side data by the web application (CNVD/CVEs describe it as a cross-site scripting flaw). Practical impact is client-side code execution within ...

CVE-2020-9007

Codoforum 4.8.8 allows self-XSS via the title of a new topic...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

New Relic: CRLF Injection in email address

The researcher discovered an issue where control characters can be used when intercepting a request to update an email address. This would result in an inaccessible account without intervention by our Support team. As denial-of-service is out of scope for our program, and since it is scoped to a...

Ubuntu 18.04 LTS : MariaDB vulnerability (USN-4250-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4250-2 advisory. It was discovered that an unspecified vulnerability existed in the C API component of MariaDB. An attacker could use this to cause a denial of service for MariaDB...

Fedora 31 : xar (2020-edf53cd770)

The remote Fedora 31 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2020-edf53cd770 advisory. - Use Apple upstream instead of non-fresh Github one - New upstream in 1.8 dev branch with 417.1 subversion - Close CVE-2018-17093 - Close...

USN-4250-2 mariadb-10.1, mariadb-10.3 vulnerability

It was discovered that an unspecified vulnerability existed in the C API component of MariaDB. An attacker could use this to cause a denial of service for MariaDB clients. MariaDB has been updated to 10.3.22 in Ubuntu 19.10 and 10.1.44 in Ubuntu 18.04 LTS. In addition to security fixes, the updat...

After the Iowa Caucus Meltdown, New Hampshire Says It’s Ready

The nation’s first primary is proudly low-tech, but it'll take more than paper ballots to defuse the disinformation threat...

New Relic: Bypassing Protection Mechanism: Change of Account Name after Session Log out

The researcher illustrated a delay in session invalidation. This has not been added to our public policy to help prevent confusion...

CVE-2019-15617

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...

WhatTheHack - A Collection Of Challenge Based Hack-A-Thons Including Student Guide, Proctor Guide, Lecture Presentations, Sample/Instructional Code And Templates

WhatTheHack is a collection of challenge based hack-a-thons including student guide, proctor guide, lecture presentations, sample/instructional code and templates. What, Why and How "What the Hack" is a challenge based hackathon format Challenges describe high-level tasks and goals to be...

New Relic: Secure credentials values disclosure to regular users due to access control issue in monitor creating function

@skavans discovered a test endpoint for Syntethics monitors that did not properly validate the permissions of the user making the request. This could allow lesser privileged users on the same to account create monitors using Secure Credentials...

New Relic: Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

@skavans identified an endpoint for testing Synthetics monitors. Without proper validation, this could allow monitors from other accounts to run on your account with knowledge of the monitor's ID: POST /accounts//monitors/monitor/recheck.json?monitorId= HTTP/1.1 Host: synthetics.newrelic.com...