PT-2020-5294 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a lack of protection for system data in the Windows operating system. It allows an attacker to disclose protected information in Windows error reports. This can...

Hijackthis - A Free Utility That Finds Malware, Adware And Other Security Threats

HiJackThis Fork is a free utility for Microsoft Windows that scans your computer for settings changed by adware, spyware, malware and other unwanted programs. HiJackThis Fork primarily detects hijacking methods rather than comparing items against a pre-built database. This allows it to detect new...

CVE-2020-13942

creationtimestamp| type| source ---|---|--- 2020-11-23 03:53:17+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2119 2020-11-23 09:45:55+00:00| published-proof-of-concept| https://t.me/cKure/2943 2020-11-24 20:46:57+00:00| seen| https://t.me/cibsecurity/16796 2023-11-22...

CVE-2020-11831

OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1...

Code injection

OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1...

CVE-2020-11831

The CVE-2020-11831 entry concerns Oppo’s OvoiceManager (v2.0.1) that grants the system permission to write vulnerability reports for arbitrary files. The root cause is improper permission handling within OvoiceManager, enabling writes to arbitrary file paths with SYSTEM privileges, which can lead...

OPPO Oppo OvoiceManager Security Vulnerability

OPPO Oppo OvoiceManager is a voice management service for devices from China's OPPO Guangdong Mobile Communications OPPO. A security vulnerability exists in version 2.0.1 of com.oppo.ovoicemanager that stems from OvoiceManager having system privileges to write vulnerability reports for arbitrary...

FAMA - Forensic Analysis For Mobile Apps

LabCIF -Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. Functionalities Extract user application data from an...

USN-4171-6: Apport regression

USN-4171-1 fixed vulnerabilities in Apport. The update caused a regression when handling configuration files. This update fixes the problem, and also introduces further hardening measures. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as...

Anuko Time Tracker 1.19.23.5325 CSV Injection

Exploit Title: Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection Date: 2020-10-17 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.anuko.com/ Software Link: https://www.anuko.com/time-tracker/index.htm Version: 1.19.23.5325 Tested on: Kali Linux 2020.3 CVE: CVE-2020-15255...

kernel: net: bluetooth: heap buffer overflow when processing extended advertising report events

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the syste...

CVE-2020-6362

SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn...

Authorization

SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn...

CVE-2020-6362

CVE-2020-6362 affects SAP Banking Services 500, where an incorrect authorization object in certain reports allows privilege escalation and potential segregation-of-duties violations. The vulnerability could result in service interruptions and system unavailability for affected users. The root cau...

Automattic: [api.tumblr.com] Denial of Service by cookies manipulation

Hello Summary: I have found at api.tumblr.com two parameters consumerkey && consumersecret allow to modify oa-consumerkey && oaconsumersecret cookies values and property. An attacker can send a malicious link to reset the cookies of api.tumblr.com, this lead to DOS. To trigger the DOS, the...

Computing at the Edge

Welcome to the Akamai October 2020 Update - a week of product updates, new features, and innovations. We'll be highlighting a different area of our portfolio each day this week. In today's post, we look at our enhanced edge computing capabilities and how they help developers more effectively and...

NERVE - Network Exploitation, Reconnaissance & Vulnerability Engine

NERVE is a vulnerability scanner tailored to find low-hanging fruit level vulnerabilities, in specific application configurations, network services, and unpatched services. It is not a replacement for Qualys, Nessus, or OpenVAS. It does not do authenticated scans, and operates in black-box mode...

Microsoft Overhauls ‘Patch Tuesday’ Security Update Guide

Microsoft has updated its Security Update Guide, which is used by tens of millions of cybersecurity professionals the second Tuesday of every month, also known as Patch Tuesday. The update, according to Microsoft, is meant to deliver a more intuitive user experience. For its latest update,...

Exploit for Improper Access Control in Elasticsearch

欢迎各位大佬提BUG,当前版本 AssetScanV1.3 周期 初版：2019年11月28日 V1.0初版编写完成 修改1：2019年12月02日 感谢Shadow·J反馈kali下文件导入异常 修改2：2019年12月03日 V1.1发布，新增ARP存活检测（回滚，测bug） 修改3：2019年12月04日 V1.2发布，修复漏洞脚本异常，修复weblogic脚本 修改4：2019年12月05日 V1.2修改，感谢sevck提供设计思路以及代码不规范问题 修改5：2019年12月05日 V1.2修改，修复IP数据处理异常 修改6：2019年12月19日...

CVE-2020-16099

In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...