PT-2021-9036 · Tk Star · Tk-Star Q90 Junior Gps

Name of the Vulnerable Software and Affected Versions: TK-Star Q90 Junior GPS horloge version 3.1042.9.8656 Description: An issue was discovered where any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device produces a "Remove PIN and restart!" message an...

CentOS 8 : thunderbird (CESA-2020:3634)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3634 advisory. - Mozilla: Attacker-induced prompt for extension installation CVE-2020-15664 - Mozilla: Use-After-Free when aborting an operation CVE-2020-15669 Note...

CentOS 8 : firefox (CESA-2020:3557)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3557 advisory. - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: WebRTC permission prompt could have been bypassed by a...

UBUNTU-CVE-2021-23956

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox 85...

Metasploit Wrap-Up

Metasploit Wrapup Windows print spooler vulnerability...again Here we have bwatters-r7 coming in with an exploit for CVE-2020-1337, a patch bypass for a Windows print spooler elevation of privilege vulnerability that was exploited in the wild last year. The original vulnerability, CVE-2020-1048,...

The vulnerability of the fly-wm window manager, related to the bypassing of authentication due to a fundamental error, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the fly-wm window manager is related to the password prompt displayed during session blocking. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

CVE-2020-27059

In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2020-17500

Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection issue 1 of 4. The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result i...

Barco Transform NDN Device Command Injection Vulnerability

The Barco Transform NDN Device is a PC-based network graphics processor from Barco in the Netherlands. The device displays encoded streams from Gbit Ethernet/IP networks and supports formats such as H-264, MPEG-4, MPEG-2, MJPEG, V2D and ProServer. A security vulnerability exists in the Barco...

sar2html 3.2.1 - 'plot' Remote Code Execution

Exploit Title: sar2html 3.2.1 - 'plot' Remote Code Execution Date: 27-12-2020 Exploit Author: Musyoka Ian Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Ubuntu 18.04.1 !/usr/bin/env python3 import requests...

SearchDimension search hijackers: An overview of developments

Background information on SearchDimension SearchDimension is the name of a family of browser hijackers that makes money from ad clicks and search engine revenues. The family was named after the domain searchdimension.com that popped up in 2017, and they still sometimes use the letter combo SD in...

Mimosa Cloud. Invite friends, not hackers

TL;DR Global wireless network provider had an IDOR in their cloud management platform Anyone can create an account, anyone can upgrade that account to take control of anyone else’s devices Excellent VDP, responded to promptly Fixed in ONE WORKING DAY! Other vendors can learn from Mimosa Who? Mimo...

Adobe Reader < 2017.011.30188 / 2020.001.30018 / 2020.013.20074 Vulnerability (APSB20-75)

The version of Adobe Reader installed on the remote Windows host is a version prior to 2017.011.30188, 2020.001.30018, or 2020.013.20074. It is, therefore, affected by a vulnerability. - Acrobat Reader DC versions 2020.013.20066 and earlier, 2020.001.30010 and earlier and 2017.011.30180 and earli...

SUSE SLED15 / SLES15 Security Update : gnome-settings-daemon, gnome-shell (SUSE-SU-2020:3132-1)

This update for gnome-settings-daemon, gnome-shell fixes the following issues : gnome-settings-daemon : Add support for recent UCM related changes in ALSA and PulseAudio. jscSLE-16518 Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. jscSLE-16518 Don't...

Security update for MozillaThunderbird (moderate)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2020:2133-1 Rating: moderate References: 1178611 Cross-References: CVE-2020-26950 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update f...

SUSE-SU-2020:3418-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.4.2 MFSA 2020-49 bsc1178611 CVE-2020-26950 bmo1675905 Write side effects in MCallGetProperty opcode not accounted for - Mozilla Thunderbird 78.4.1 new: Thunderbird prompts for an address to use when starting a...

openSUSE Security Update : gnome-settings-daemon / gnome-shell (openSUSE-2020-1861)

This update for gnome-settings-daemon, gnome-shell fixes the following issues : gnome-settings-daemon : - Add support for recent UCM related changes in ALSA and PulseAudio. jscSLE-16518 - Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. jscSLE-16518 -...

USN-4599-3 firefox regressions

USN-4599-1 and USN-4599-2 fixed vulnerabilities in Firefox. The updates introduced various minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a...

EulerOS 2.0 SP5 : mutt (EulerOS-SA-2020-2258)

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.CVE-2020-14093 - Mutt before 1.14.4 and NeoMutt befo...

Spoofing

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external...