The vulnerability of the Windows GDI component in Windows operating systems allows attackers to disclose protected information.

The vulnerability of the Windows GDI component in Windows operating systems is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of the Windows Host Guardian Service on Microsoft Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows Host Guardian Service on Microsoft Windows operating systems is related to improper checking of recorded and registered hashes. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of the software update service for Cisco Webex Meetings Desktop App allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the software update service for the Cisco Webex Meetings Desktop App is related to authentication deficiencies. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

A vulnerability in the web access function of the microprogramming software used in Cisco IP Phones 7800 and Cisco IP Phones 8800 allows a perpetrator to disclose protected information.

The vulnerability in the web access function of Cisco IP Phones 7800 and Cisco IP Phones 8800 is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information by sending specially crafted requests to the vulnerable...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015/Reader 2015 involve reading beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can...

The vulnerability of the Microsoft Visual Studio Code Live Share Extension, related to the lack of data protection for service data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft Visual Studio Code Live Share Extension relates to the lack of protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by intercepting tokens from the client to...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015/Reader 2015 involve reading beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can...

SRC-2020-0020 : Microsoft SharePoint Server ExchangeAutodiscover GetDataFromURL Blind Server-Side Request Forgery Tampering Vulnerability

Vulnerability Details: This vulnerability allows remote attackers escalate privileges under certain conditions. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetFreeBusyStatusForOneUser function inside of the AsynchronousWebPartService class. The...

Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks

By Nick Biasini, Edmund Brumaghin and Mariano Graziano. Threat summary Attackers are actively distributing the Valak malware family around the globe, with enterprises, in particular, being targeted.These campaigns make use of existing email threads from compromised accounts to greatly increase...

Cellebrite UFED Trust Management Issues Vulnerability (CNVD-2020-51755)

Cellebrite UFED is a universal forensic product from Cellebrite Israel. The product is mainly used for data extraction, transmission and analysis of devices. A security vulnerability exists in Cellebrite UFED versions 5.0 through 7.5.0.845. An attacker could exploit the vulnerability to access...

CVE-2020-14474

The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device...

Hardcoded credentials

The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device...

The vulnerability of the software key storage mechanism of Cisco Application Services Engine allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco Application Services Engine software repository is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the multimedia framework Media Foundation in Microsoft Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Media Foundation multimedia framework in Microsoft Windows operating systems relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created malicious...

The vulnerability of the IEEE 802.11w Protected Management Frames (PMFs) in the Cisco IOS XE operating system allows a hacker to disrupt a user’s legitimate connection to a vulnerable device.

The vulnerability of the IEEE 802.11w Protected Management Frames PMFs in the Cisco IOS XE operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to successfully disconnect a user’s connection to a vulnerable device...

CVE-2020-12024

Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to th...

The vulnerability of the OAuth implementation in the Zoho ManageEngine ServiceDesk Plus system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OAuth implementation in the Zoho ManageEngine ServiceDesk Plus IT service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability in the web browser Internet Explorer, related to errors in memory object handling, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability in the web browser Internet Explorer is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Media Foundation component in Windows operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Media Foundation component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information by using a specially...

Microsoft Edge’s vulnerability related to request processing errors allows attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft Edge is related to errors in request processing. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...