The vulnerability of the Squid proxy server, related to the lack of a authentication mechanism for url_regex, allows attackers to gain access to blocked resources.

The vulnerability of the Squid proxy server is related to the lack of authentication mechanism for urlregex. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to blocked resources...

Huawei Data Communication: FragmentSmack Vulnerability in Linux Kernel (huawei-sa-20190123-01-linux)

There is a DoS vulnerability in the Linux Kernel versions 3.9+ known as a FragmentSmack attack. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Xxe

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364...

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Joomla Resources Directory Users Exposed in Leaky AWS Bucket

An Amazon Web Services AWS cloud storage bucket that was left open to the public internet has exposed thousands of Joomla users’ personal information. About 2,700 individuals who signed up to use the Joomla Resources Directory JRD – a community forum for finding developers and service providers...

Cross-site Scripting (XSS)

com.liferay.asset.browser.web is vulnerable to cross-site scripting XSS. The vulnerability exists as the values of assetRenderer.getTitlelocale and assetRenderer.getSummaryrenderRequest, renderResponse in resources/view.jsp is not sanitized...

The vulnerability of the load_aout_binary() function in the Linux operating system’s kernel allows a hacker to bypass the ASLR protection mechanism.

The vulnerability of the loadaoutbinary function in the Linux operating system arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to bypass the ASLR protection mechanism in programs with setuid a.out...

Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

CVE-2020-4018

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery CSRF vulnerability...

My Advice For Candidates During the COVID-19 Environment

Kerry Condon is Global Head of Talent Acquisition at Akamai Technologies. With more than 20 years' experience as a strategic human resources leader across emerging and developed markets, she shares her take on how candidates can put their best foot forward during these unusual times...

The vulnerability of the HSTATE_HOST_R1 component of the Kernel-based Virtual Machine (KVM) virtualization subsystem in Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the HSTATEHOSTR1 component of the Linux Kernel-Based Virtual Machine KVM virtualization subsystem arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the pivot_root function (fs/namespace.c) in Linux operating system kernels, which allows a hacker to trigger a service failure

The vulnerability of the pivotroot function fs/namespace.c in Linux operating system kernels arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

MemoryMapper - Lightweight Library Which Allows The Ability To Map Both Native And Managed Assemblies Into Memory

Memory Mapper is a lightweight library which allows the ability to map both native and managed assemblies into memory by either using process injection of a process specified by the user or self-injection; the technique of injecting an assembly into the currently running process attempting to do...

CVE-2020-4246

IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 175481...

Xxe

IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 175481...

CVE-2020-4246

IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 175481...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

Cisco Adaptive Security Appliance Software SSL/TLS DoS (cisco-sa-asa-ssl-vpn-dos-qY7BHpjN)

A vulnerability exists in the Secure Sockets Layer SSL/Transport Layer Security TLS handler of Cisco Adaptive Security Appliance ASA Software due to improper resource management for inbound SSL/TLS connections. An unauthenticated, remote attacker can exploit this, by establishing multiple SSL/TLS...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1591)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to acce...