Authorization

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight...

CVE-2020-11844 Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight...

CVE-2020-1809

HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143C00E143R2P4 have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone...

CVE-2020-1809

HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143C00E143R2P4 have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone...

‘Hack-For-Hire’ Firms Spoof WHO To Target Google Credentials

“Hack-for-hire” organizations are the latest group of cybercriminals to take advantage of the ongoing coronavirus pandemic, using COVID-19 as a lure in phishing emails bent on stealing victims’ Google credentials. Researchers with Google’s Threat Analysis Group TAG warned that they’ve spotted a...

The zero-day exploits of Operation WizardOpium

Back in October 2019 we detected a classic watering-hole attack on a North Korea-related news site that exploited a chain of Google Chrome and Microsoft Windows zero-days. While we've already published blog posts briefly describing this operation available here and here, in this blog post we'd li...

Apple macOS Catalina PackageKit Component Unauthorized Operation Vulnerability

Apple macOS Catalina is a proprietary operating system developed by Apple for Mac computers.PackageKit is an open-source suite of applications for installing and updating Linux software. A security vulnerability exists in the PackageKit component of Apple macOS Catalina versions prior to 10.15.5...

SQLite Unauthorized Operation Vulnerability

SQLite is the United States D. Richard Hipp software developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. There is a security vulnerability in versions prior to SQLite 3.32.0...

UBUNTU-CVE-2020-13253

sdwpaddr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhciwrite operations. A guest OS user can crash the QEMU process...

CVE-2020-13623

JerryScript 2.2.0 allows attackers to cause a denial of service stack consumption via a proxy operation...

Design/Logic Flaw

JerryScript 2.2.0 allows attackers to cause a denial of service stack consumption via a proxy operation...

CVE-2020-13623

JerryScript 2.2.0 allows attackers to cause a denial of service stack consumption via a proxy operation...

CVE-2020-13623

JerryScript 2.2.0 allows attackers to cause a denial of service stack consumption via a proxy operation...

CVE-2020-13623

CVE-2020-13623 affects JerryScript 2.2.0. An attacker can cause a denial of service (stack consumption) via a proxy operation. The issue is documented across multiple feeds (NVD, Red Hat, Ubuntu, OSV, etc.). Exploitation details are not provided in the initial or connected documents, and remediat...

CVE-2020-13623

Removed by vendor...

CVE-2020-10134

Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedure...

CVE-2020-10134

CVE-2020-10134 affects Bluetooth Core v5.2 and earlier. The vulnerability arises during pairing when an unauthenticated attacker can perform a man-in-the-middle by exploiting users completing two pairing procedures with the MITM using one peer’s confirmation as the other peer’s passkey. This can ...

cryptacular: excessive memory allocation during a decode operation

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...

cryptacular: excessive memory allocation during a decode operation

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...

cryptacular: excessive memory allocation during a decode operation

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...