CVE-2020-8185

A denial of service vulnerability exists in Rails 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization. By default, an attacker is able to execute any migrations that are pending for a Rails app running in production mode. Remediation Upgrade actionpack to version 6.0.3.2 or higher. References - GItHub Commit - Rai...

Crooks Tap Google Firebase in Fresh Phishing Tactic

A series of phishing campaigns using Google Firebase storage URLs have surfaced, showing that cybercriminals continue to leverage the reputation of Google’s cloud infrastructure to dupe victims and skate by secure email gateways. Google Firebase is a mobile and web application development platfor...

Man-in-the-Middle (MitM)

Overview em-imap is a gem that allows you to connect to an IMAP4rev1 server in a non-blocking fashion. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. The hostname in a TLS server certificate is not verified. An attacker can assume the identity of a trusted server and...

USN-4360-3 json-c regression

USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a memory leak in some scenarios. This update reverts the security fix pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that json-c incorrectly handled certain JSO...

servizionline.comune.preganziol.tv.it Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1151773 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

You may experience slow logon when services are in start-pending state in Windows Server 2012 R2

You may experience slow logon when services are in start-pending state in Windows Server 2012 R2 This article describes an issue that occurs when you try to log on to Windows Server 2012 R2 by using Remote Desktop Services RDS. You can fix this issue by using the update in this article. Before yo...

books.gpl.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-1136526 Security Researcher keritzy Helped patch 2026 vulnerabilities Received 5 Coordinated Disclosure badges Received 4 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting books.gpl.org website and i...

HackerOne: Changes to data in a CVE request after draft via GraphQL query

Summary: Our team has conducted a number of studies tests in the field of CVE Request. We found several statuses of such requests Awaiting Publication, Pending HackerOne approval, Cancelled . At the time of creating the request , we can change the data. However, we noticed that we can 't change...

PT-2020-6881 · Abb · Abb Esoms

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 to 6.0.3 Description: The issue is related to errors in processing requests, which can allow a remote attacker to disclose protected information. Specifically, HTTPS responses contain comments with sensitive information...

DEBIAN-CVE-2015-2689

Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service assertion failure and daemon exit via crafted packets...

CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

CVE-2020-5502

The CVE-2020-5502 entry concerns phpBB 3.2.8, where a cross-site request forgery (CSRF) vulnerability could approve pending group memberships. The connected documents corroborate the same issue across multiple feeds (Red Hat, OSV, GHSA, CNVD, NVD, and other vulnerability trackers) without providi...

PT-2020-18483 · Phpbb Limited · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, enabling the approval of pending group memberships without proper authorization. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for...

CVE-2019-6686

On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, the Traffic Management Microkernel TMM might stop responding after the total number of diameter connections and pending messages on a single virtual server has reached 32K...

Superlist <= 2.9.2 - Stored Cross-Site Scripting (XSS)

Persistent XSS was discovered in the 'Superlist - Directory WordPress Theme', the version tested was v2.9.2. Edit WPScanTeam: December 2nd, 2019 - Envato Contacted December 2nd, 2019 - Envato Investigating December 12th, 2019 - No updates, disclosing PoC The PoC will be displayed once the issue h...

UBUNTU-CVE-2019-19204

An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read...

Moneybird: Pending MFA logins aren't immediatly expired after a password change

Researcher found an issue with sessions not all being terminated when password is changed. The 2FA implementation was at fault in this scenario as the session was found to be active even after the password was changed and two-step verification was turned off...