Mozilla: Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...

Mozilla: Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...

CVE-2019-5613

In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated...

CVE-2019-5613

In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated...

Return Of Bleichenbacher's Oracle Threat

ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: The details are pretty heavily documented on robotattack.org, so no need to...

Google Chrome Heap Corruption Vulnerability (CNVD-2020-05122)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A heap corruption vulnerability exists in Google Chrome versions prior to 80.0.3987.87. The vulnerability stems from an improper implementation of Blink in Google...

Authentication flaw

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

FreeBSD Security Vulnerabilities

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD has a security vulnerability. An attacker can re-inject old packets, which will be accepted and processed by the IPsec endpoint. No details of the vulnerability are provided at this time...

Malicious takeover of previously owned ENS names

Impact A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness. Patches A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry...

Shell Backdoor List - PHP / ASP Shell Backdoor List

What is a shell backdoor ? A backdoor shell is a malicious piece of code e.g. PHP, Python, Ruby that can be uploaded to a site to gain access to files stored on that site. Once it is uploaded, the hacker can use it to edit, delete, or download any files on the site, or upload their own. How to...

Alleged Member of Neo-Nazi Swatting Group Charged

Federal investigators on Friday arrested a Virginia man accused of being part of a neo-Nazi group that targeted hundreds of people in "swatting" attacks, wherein fake bomb threats, hostage situations and other violent scenarios were phoned in to police as part of a scheme to trick them into...

KeePass CSV Injection Vulnerability

KeePass is a free open source password manager that helps you manage your passwords in a secure way. A CSV injection vulnerability exists in KeePass 2.4.1 and earlier versions, which can be exploited by an attacker to conduct a CSV injection attack via the title field of a CSV export...

AZL-36949 CVE-2019-19977 affecting package libesmtp for versions less than 1.0.6-21

libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlmbuildtype2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read...

DEBIAN-CVE-2019-19956

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-oldNs...

Unspecified Vulnerability in Forcepoint NGFW Security Management Center

Forcepoint NGFW Security Management Center SMC is a Forcepoint product that provides unified, centralized management capabilities for Forcepoint's next-generation firewalls. A security vulnerability exists in Forcepoint NGFW SMC versions prior to 6.5.12 and prior to 6.7.1. An attacker could explo...

cPanel Access Control Error Vulnerability (CNVD-2020-03743)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in cPanel versions prior to 70.0.23. An attacker can exploit this vulnerability to bypass .htacce...

chromium-browser: Insufficient policy enforcement in navigation

Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Apple iPhone 3GS Non-Null Pointer Vulnerability

The Apple iPhone 3GS is a smartphone from the American company Apple. A security vulnerability exists in the Apple iPhone 3GS old bootrom and new bootrom. An attacker can exploit the vulnerability to install arbitrary firmware...

The vulnerability of the multires_load_old_dm component in the software suite for creating 3D computer graphics in Blender allows a hacker to execute arbitrary code.

The vulnerability of the multiresloadolddm component in the software suite used for creating 3D computer graphics in Blender is due to a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created blend file...