Authentication flaw

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 December 2019...

CVE-2019-20532

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 December 2019...

Cross-Site Scripting (XSS)

github.com/gogs/gogs is vulnerable to cross-site scripting XSS. The x-content-type-options header value is not configured to nosniff, which causes the user's browser to perform mime-type sniffing when viewing a raw file. This can lead to arbitrary execution of Javascript in a raw file...

Security Bulletin: WebSphere Message Broker / IBM Integration Bus WEBUI does not set X-FRAME-OPTIONS (CVE-2016-9010)

Summary WebSphere Message Broker / IBM Integration Bus WEBUI does not set X-FRAME-OPTIONS Vulnerability Details CVEID: CVE-2016-9010 DESCRIPTION: IBM WebSphere Message Broker could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious web...

Option to Install Veeam ONE Agent is Unavailable (Greyed Out)

Challenge When attempting to install the Veeam ONE Agent on a Veeam Backup Server, theInstall agent option is unavailable and greyed out. Cause There are several possible causes for this issue: The Veeam ONE Agent is already installed on the Veeam Backup & Replication Server. The Veeam ONE Server...

5 Best Internet Service Locators

By Waqas By using an internet service locator will allow you to learn about all of your options for service providers before you commit to a company. This is a post from HackRead.com Read the original post: 5 Best Internet Service Locators...

phpMyAdmin -- SQL injection

phpMyAdmin Team reports: PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password PMASA-2020-3 SQL injection vulnerability relating to the search feature PMASA-2020-4 SQL injection and XSS having to do with displaying results Removing of the...

openSUSE Security Update : salt (openSUSE-2020-357)

This update for salt fixes the following issues : - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

gulp-styledocco injection vulnerability

gulp-styledocco is a package for generating documentation from stylesheets and style guide documentation. A security vulnerability exists in gulp-styledocco 0.0.3 and earlier versions, which stems from the program failing to clean up the 'options' parameter. An attacker can exploit this...

closure-compiler-stream injection vulnerability

closure-compiler-stream is a stream interface to a closure compiler. A security vulnerability exists in closure-compiler-stream version 0.1.15 and earlier, which stems from the program failing to perform any cleanup operations on the user-controllable 'options' parameter. An attacker could use th...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:0684-1)

This update for salt fixes the following issues : Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 Fix unit tests failures in testbatchasync tests Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

Code injection

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

SUSE-RU-2020:0685-1 Recommended update for Salt

This update fixes the following issues: salt: - RHEL/CentOS 8 uses platform-python instead of python3 - New configuration option for selection of grains in the minion start event. - Fix 'osfamily' grain for Astra Linux Common Edition - Fix for salt-api NET API where unauthenticated attacker could...

Command Injection

Overview gulp-styledocco is a StyleDocco plugin for gulp. Affected versions of this package are vulnerable to Command Injection. The argument options of the exports function in index.js can be controlled by users without any sanitization. PoC var root = require"gulp-styledocco"; var gulp =...

Command Injection

Overview closure-compiler-stream is a Streaming interface for closure compiler. Affected versions of this package are vulnerable to Command Injection. The argument options of the exports function in index.js can be controlled by users without any sanitization. PoC var root =...