Authorization

SAP S/4HANA Financial Products Subledger, version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability would allow an authenticated attacker to view, change, or delete data,...

CVE-2020-6214

The CVE describes SAP S/4HANA (Financial Products Subledger), Version 100, as vulnerable due to an incorrect authorization object in certain reports. The underlying vulnerability allows an authenticated attacker to view, change, or delete data, compromising separation of duties within the system....

Topcoder: SVG file upload leads to XML injection

Summary: Upload Avatar option allows the user to upload image/ . Thus enabling the upload of many file formats including SVG files MIME type: image/svg+xml SVG files are XML based graphics files in 2D images. Thus, this opens up an attack vector to upload specially crafted malicious SVG files. Th...

CVE-2020-2173

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content...

CVE-2020-2173

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content...

Cross site scripting

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content...

CVE-2020-2173

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content...

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service allows a malicious actor to create a publicly accessible report of a software bug for a privileged process.

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for the privileged process...

CVE-2020-11455

creationtimestamp| type| source ---|---|--- 2020-04-06 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48297 2020-04-14 17:13:45+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/limesurveyziptraversals.rb 2025-02-06...

The vulnerability of the apport operating system’s error registration service, related to synchronization errors when using a shared resource, allows a malicious actor to create a publicly accessible report of the software bug for privileged processes.

The vulnerability of the apport operating system’s error registration service is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to create a publicly accessible report of the software bug for privileged processes...

CVE-2020-8515

creationtimestamp| type| source ---|---|--- 2020-03-27 23:08:11+00:00| exploited| https://t.me/ctinow/21855 2020-04-06 14:30:02+00:00| exploited| https://t.me/SecLabNews/7285 2020-04-10 16:33:40+00:00| exploited| https://t.me/truesecator/456 2020-07-14 09:25:17+00:00| seen|...

Envizon v3.0 - Network Visualization And Vulnerability Management/Reporting

This tool is designed, developed and supported by evait security. In order to give something back to the security community, we publish our internally used and developed, state of the art network visualization and vulnerability reporting tool, 'envizon'. We hope your feedback will help to improve...

March 2020 -- Akamai Edge Security: Leader in Five Forrester Wave Reports

Forrester has named Akamai a Leader in five different Wave and New Wave reports. This significant achievement reflects the strength of Akamai's intelligent edge platform for securing and delivering digital experiences across our entire security portfolio. Forrester Wave Leaders are the top vendor...

USN-4171-5: Apport regression

USN-4171-1 fixed vulnerabilities in Apport. This caused a regression in autopkgtest and python2 compatibility. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root...

$100K Paid Out for Google Cloud Shell Root Compromise

Google has awarded its inaugural annual top prize for the Google Cloud Platform GCP, for vulnerabilities found in the Google Cloud Shell. The find — a container escape that leads to host root access and the ability to use privileged containers — has earned $100,000 for Dutch researcher Wouter ter...

SAP Crystal Reports RPT File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

SAP Business Objects Business Intelligence Platform Code Injection Vulnerability

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A security vulnerability exists in SAP Business Objects Business...

CVE-2020-0796

creationtimestamp| type| source ---|---|--- 2020-03-10 22:20:17+00:00| exploited| https://t.me/ctinow/21179 2020-03-10 23:02:59+00:00| exploited| https://t.me/BleepingComputer/6947 2020-03-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=458 2020-03-11 09:46:14+00:00|...

CVE-2020-6208

SAP Business Objects Business Intelligence Platform Crystal Reports, versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution...

FuzzBench - Fuzzer Benchmarking As A Service

FuzzBench is a free service that evaluates fuzzers on a wide variety of real-world benchmarks, at Google scale. The goal of FuzzBench is to make it painless to rigorously evaluate fuzzing research and make fuzzing research easier for the community to adopt. We invite members of the research...