Server side request forgery (ssrf)

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

CVE-2020-0464

In resolvcachelookup of rescache.cpp, there is a possible side channel information disclosure. This could lead to local information disclosure of accessed web resources with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Information disclosure

In resolvcachelookup of rescache.cpp, there is a possible side channel information disclosure. This could lead to local information disclosure of accessed web resources with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-0464

In resolvcachelookup of rescache.cpp, there is a possible side channel information disclosure. This could lead to local information disclosure of accessed web resources with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Azure Policies

Welcome back to Part Two of our four-part Blueprint Series. Today's post covers the use of Azure Policies within a Blueprint deployment along with ARM templates and permissions management. Azure Policies are the critical component of Azure Blueprints. Policies, like ARM Templates, are JSON...

CSS paint API: Being predictably random

Take a look at this: Space invaders If you're using a browser that supports the CSS paint API, the element will have a 'random' pixel-art gradient in the background. But it turns out, doing random in CSS isn't as easy as it seems… Initial implementation This isn't a full tutorial on the CSS paint...

The vulnerability of the sysctl hugetlbl utility in the Linux operating system allows a hacker to cause a service failure or increase privileges.

The vulnerability of the sysctl hugetlbl utility in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures or elevate privileges...

New cloud-native breadth threat protection capabilities in Azure Defender

As the world adapts to working remotely, the threat landscape is constantly evolving, and security teams struggle to protect workloads with multiple solutions that are often not well integrated nor comprehensive enough. This results in serious threats avoiding detection, as well as security teams...

Ubuntu: Security Advisory (USN-4668-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ASA-202012-19] gdk-pixbuf2: denial of service

Arch Linux Security Advisory ASA-202012-19 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1328 Summary ======= The package gdk-pixbuf2 before...

[ASA-202012-20] lib32-gdk-pixbuf2: denial of service

Arch Linux Security Advisory ASA-202012-20 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : lib32-gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1329 Summary ======= The package...

New ACSC Cybersecurity Campaign Begins by Focusing on Ransomware Threats

The Australian Cyber Security Centre ACSC has launched a new cyber security campaign encouraging all Australians to protect themselves against online threats. The initial focus of the campaign is ransomware threats, and the ACSC provides easy-to-follow security advice at cyber.gov.au to help...

Gitlab CE/EE Input Validation Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in Gitlab CE/EE version...

Directory Traversal Vulnerability in Human Resource Management System of Dongguan Zhiyue Software Technology Co.

Ltd. is a high-tech enterprise with independent intellectual property rights and its own brand, integrating R&D, production, sales and service. Ltd. Human Resources Management System has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information...

Cross-Site Scripting (XSS)

Google Chrome is vulnerable to cross-site scripting. An attacker is able to inject a WPAD file on the local network segment to proxy resources on localhost...

Denial Of Service (DoS)

wireshark is vulnerable to denial of service. It is possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file...

ASB-A-150371903

In resolvcachelookup of rescache.cpp, there is a possible side channel information disclosure. This could lead to local information disclosure of accessed web resources with no additional execution privileges needed. User interaction is not needed for exploitation...

Directory traversal in development mode handler in Vaadin 14 and 15-17

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. See CWE-20: Improper...

MicroStrategy Cross-Site Request Forgery Vulnerability

Microstrategy is a suite of business analytics and mobility platforms from US-based Microstrategy. MicroStrategy version 10.4 suffers from a cross-site request forgery vulnerability that could allow an authenticated user to access the content of an internal web resource or leak files from a local...

The vulnerability of Junos operating system’s MX series routers, related to synchronization errors when using shared resources, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Junos operating system’s MX series routers is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...