Oracle E-Business Suite Human Resources SQL Injection (CVE-2020-2956)

An SQL execution vulnerability exists in the Position Hierarchy Viewer module of the Human Resources component in Oracle E-Business Suite. The vulnerability is due to use of untrusted user input to build a portion of an SQL query string...

Security Bulletin: File vulnerabilities affect IBM SmartClound Entry

Summary IBM SmartCloud Entry is vulnerable to file vulnerabilities, An attacker could exploit these vulnerabilities to use a specially-crafted file to consume all available CPU resources, cause a denial of service, execute arbitrary code, or cause applications/executables to crash. CVE-2014-3538...

Security Bulletin: Multiple vulnerabilities in openssl, gnutl, mysql, kernel, glibc, ntp shipped with SmartCloud Entry Appliance

Summary Multiple vulnerabilities have been idintified in openssl, gnutl, mysql, kernel, glibc and ntp shipped with SmartCloud Entry Appliance. SmartCloud Entry Appliance has addressed the vulnerabilities. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: The SSL/TLS protocol is vulnerable t...

[ASA-202007-2] wireshark-cli: denial of service

Arch Linux Security Advisory ASA-202007-2 ========================================= Severity: Low Date : 2020-07-18 CVE-ID : CVE-2020-15466 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1198 Summary ======= The package wireshark-cli before...

The vulnerability of the VMware Tools utility set for Windows operating systems arises from synchronization errors when using shared resources, allowing a malicious individual to gain increased privileges.

The vulnerability of the VMware Tools utility set for Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

So much compliance to do…so little time (and people!)

In my seven years at Coalfire I've had the pleasure of working with dedicated compliance professionals at organizations of all shapes and sizes. Over time I've seen the pressure on these fine folks increase tenfold as the stream of new compliance obligations jumps its banks and becomes a flood. T...

CVE-2020-4462

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

Xxe

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

CVE-2020-4462

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

Exploit for Improper Resource Shutdown or Release in Microsoft

Web-Security-Note Record some common Web security sites 由于平常读过的文章以及遇到的比较好的开源项目都被渐渐遗忘了，所以利用这个项目来记录一下，以便查阅。 目录： - CTF - Online-Tools - 漏洞环境 - 信息搜集 - 工具 - 面经 - BypassWAF - WEB安全 - 漏洞挖掘 - 渗透测试 - 内网渗透 - 扫描器开发 - 开发 - 运维 CTF + CTF Time + Pwnhub + CTF论剑场 + 南京邮电大学CTF平台 + Whale CTF + JarvisOJ + Hackme CTF ...

Xxe

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182365...

CVE-2020-4510

CVE-2020-4510 affects IBM QRadar SIEM 7.3 and 7.4, enabling an XML External Entity (XXE) attack when processing XML data. The underlying issue allows a remote attacker to expose sensitive information or exhaust memory resources. Affected products/versions: QRadar SIEM 7.4.0 through 7.4.0 Patch 2 ...

CVE-2020-4510

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182365...

CVE-2020-12025

Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity XXE vulnerability, which may allow an attacker to view hostnames or other resources from the program...

FTC Releases Article on Protecting Small Businesses from Cyber Threats

The Federal Trade Commission FTC has released an article on their Protecting Small Business playlist, which is a collection of videos with tips for small businesses to protect their networks from common cyber scams and cyberattacks. The Cybersecurity and Infrastructure Security Agency CISA...

CVE-2020-14170

Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability...

CVE-2020-13994

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

Improper access control

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

CVE-2020-13994

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

Atlassian JIRA < 8.7.0 SSRF (JRASERVER-71204)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 8.7.0. It is, therefore, affected by a server-side request forgery vulnerability in its makeRequest servlet component. An unauthenticated, remote attacker could exploit this, ...