pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode

An out-of-bounds read was discovered in PCRE when the pattern "\X" is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to crash the application...

CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure. Recent assessments: kevthehermit at March 04, 2021 12:03am UTC reported: Vulnerability The D-LInk...

CVE-2020-15165

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHu...

CVE-2020-10775

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer...

CVE-2020-14518

Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker...

Intel® LED Manager for NUC Advisory

Summary: A potential security vulnerability in the Intel® LED Manager for NUC may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-8685 Description: Improper authentication in subsystem for Intel R LED...

CVE-2020-16227

Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execut...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists due to confusion processing a hyphen character in Date.parse, a one-byte out of bounds read could have occurred, leading to potential information disclosure...

RHEL 8 : thunderbird (RHSA-2020:3342)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3342 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 68.11.0. Security Fixes:...

USN-4450-1 whoopsie vulnerabilities

Seong-Joong Kim discovered that Whoopsie incorrectly handled memory. A local attacker could use this issue to cause Whoopsie to consume memory, resulting in a denial of service. CVE-2020-11937 Seong-Joong Kim discovered that Whoopsie incorrectly handled parsing files. A local attacker could use...

MGASA-2020-0300 Updated thunderbird packages fix security vulnerability

If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection CVE-2020-12398. When browsing a malicious page, a race condition in our...

Children Stream on Twitch—Where Potential Predators Find Them

A WIRED investigation found dozens of channels belong to children apparently under 13 and anonymous chat participants sending inappropriate messages their way...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

HackerOne: Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.

@spongebhav identified a vulnerability that let a victim believe their program membership wasn't shown on their profile, when in reality, it was. This could be used to identify system users of a program when the program blocked this...

Mozilla: Use-after-free in nsGlobalWindowInner

The Mozilla Foundation Security Advisory describes this flaw as: When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash...

The Anatomy of a Cisco Counterfeit Shows Its Dangerous Potential

By tearing down bootleg network switches, researchers found ample opportunity for malice—but no signs of a backdoor this time...

The vulnerability of the Secdo security incident investigation software lies in the insufficient validation of input data, allowing an intruder to add data to the root directory.

The vulnerability of the Secdo security incident investigation software exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to add data to the root catalog...

NVIDIA GPU Display Driver - June 2020 Security Bulletin - Lenovo Support US

No description provided...

Security update for mozilla-nss (moderate)

openSUSE Security Update: Security update for mozilla-nss Announcement ID: openSUSE-SU-2020:0955-1 Rating: moderate References: 1168669 1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability and has one errata is now available...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access

The SharePoint configuration for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of of all SharePoint's web service endpoints. The URLs are: ██████████ ███ Impact An adversary may utilize the exposed information about the web services...