CVE-2020-0531

Improper input validation in IntelR AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentially enable information disclosure via network access...

CVE-2018-21237

An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action...

Mozilla Firefox URL Forgery Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 77. An attacker could exploit the vulnerability to forge URLs...

PYSEC-2020-208

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

keycloak: problem with privacy after user logout

A flaw was found in Keycloak. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section...

CVE-2020-5336

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...

Xen Information Disclosure Vulnerability (CNVD-2020-25870)

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in xenoprof ...

Varnish Cache Information Disclosure Vulnerability

Varnish Cache is a set of reverse web caching servers. A security vulnerability exists in Varnish Cache that stems from a failure of the program to clear the pointer to the previous request when processing the next client request in the same connection. An attacker could exploit this vulnerabilit...

DEBIAN-CVE-2019-20637

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the...

D-Link Arbitrary Command Execution Vulnerability

The D-Link DAP-1650 is a WiFi range extender from AUO D-Link of Taiwan, China. A security vulnerability exists in previous versions of the D-Link DAP-1650 1.04B02J65H Hot Fix. An attacker can exploit the vulnerability to execute arbitrary commands...

sudo security update

1.8.23-4.0.2.2 - Bump release to avoid conflict with previous Orace Linux errata 1.8.23-4.2 - RHEL 7.7.z - fixed CVE-2019-18634 Resolves: rhbz1798094 1.8.23-4.1 - RHEL-7.7.z - fixed CVE-2019-14287 Resolves: rhbz1760694...

CVE-2020-8595

Istio versions 1.2.10 End of Life and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. F...

Most second-hand phones contain previous owner’s data

By Sudais Here's why you should avoid buying or selling second-hand phones or what to do before selling your smartphone to someone. This is a post from HackRead.com Read the original post: Most second-hand phones contain previous owner's data...

MTN Group: Week Passwords generated by password reset function

Summary: Assessor observed that password reset function generates only alphanumeric passwords that is passwords don't contain any special characters Also User can set old password as new password. Steps To Reproduce: Goto https://mycontract.mtn.co.za/landing/landing.htm Click forget password link...

CVE-2019-16779

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition...

CVE-2019-18987: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has accidentally or otherwise been made public, its previous versions can be exposed, thus potentially disclosing private or sensitive information within the filter's definition...

McAfee Web Gateway (MWG) Denial of Service Vulnerability (CNVD-2019-41491)

McAfee Web Gateway is a high-performance secure Web gateway with best-in-class threat protection in a unified appliance software architecture. A denial of service vulnerability exists in the scanning agent of McAfee Web Gateway MWG versions prior to 7.8.2.13. A remote attacker could exploit this...

Compatibility update for installing Windows 10, version 1903: August 27, 2019

None None...

mysql: Server: Replication unspecified vulnerability (CPU Apr 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

DRUPAL-CONTRIB-2019-060

This module provides an autocomplete widget for text fields that suggests all existing previously entered values for that field. The module doesn't sufficiently check for proper access permission before returning autocomplete results. This vulnerability is mitigated by the fact that an attacker...