Security and Human Behavior (SHB) 2021

Today is the second day of the fourteenth Workshop on Security and Human Behavior. The University of Cambridge is the host, but were all on Zoom. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro...

CVE-2020-14371

A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite...

Design/Logic Flaw

A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite...

Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks

A top Russian-language underground forum has been running a "contest" for the past month, calling on its community to submit "unorthodox" ways to conduct cryptocurrency attacks. The forum's administrator, in an announcement made on April 20, 2021, invited members to submit papers that assess the...

CVE-2020-14371

A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite...

CVE-2020-14371

CVE-2020-14371 describes a credential-leak vulnerability in Red Hat Satellite that exposes compute resources credentials through virtual machines running on Satellite resources. The issue appears in the Satellite deployment context and is documented in both the NVD entry and Red Hat security refe...

IBM Cognos Analytics XML External Entity Injection Vulnerability (CNVD-2021-38673)

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. IBM Cognos Analytics suffers fr...

File upload vulnerability in the teaching resources service management platform of Wuhan Dongxin Tongbang Information Technology Co.

Teaching Resources Service Management Platform is a system based on B/S architecture, adopting the concept of multi-level platform design, with the core functions of educational resources aggregation, categorization and storage, regional sharing, etc., and supporting activities such as remote...

CVE-2021-33181

Server-Side Request Forgery SSRF vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors...

CVE-2021-33181

Server-Side Request Forgery SSRF vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors...

CVE-2020-4300

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 176607...

CVE-2020-1920

A regular expression denial of service ReDoS vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1...

Xxe

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172533...

Xxe

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 176607...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors...

CVE-2021-33181

Server-Side Request Forgery SSRF vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors...

IBM Cognos Analytics External Entity Injection Vulnerability

IBM Cognos Analytics is a suite of business intelligence software from IBM USA that provides valuable information, secure data governance and reporting. An external entity injection vulnerability exists in Cognos Analytics 11.0 and 11.1. An attacker can exploit this vulnerability to inject extern...

Emissary 注入漏洞

Emissary is a software application. A P2P-based data-driven workflow engine that runs across heterogeneous and potentially widely distributed multi-tier P2P network computing resources. Emissary suffers from a security vulnerability that makes it susceptible to post-authentication Remote Code...

CVE-2020-4300

IBM Cognos Analytics is affected by CVE-2020-4300 due to an XML External Entity (XXE) processing flaw in 11.0 and 11.1. A remote attacker could exploit XML data to disclose sensitive information or exhaust memory. The vulnerability is within the product’s XML handling, and affected versions are I...

CVE-2020-4300

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 176607...