Information Disclosure

kernel is vulnerable to information disclosure. An L2 guest may trick the L0 hypervisor to access confidential L1 resources...

The vulnerability of the Hierarchy Diagrammers component of the Oracle Human Resources software allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Hierarchy Diagrammers component in Oracle Human Resources software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to protected information...

The vulnerability of the Hierarchy Diagrammers component of the Oracle Human Resources software allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Hierarchy Diagrammers component in Oracle Human Resources software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to protected information...

CVE-2020-12753

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving rawresources. The LG ID is LVE-SMP-200006 May 2020...

Directory Traversal

Overview io.jooby:jooby is a modular web framework for Java and Kotlin. Affected versions of this package are vulnerable to Directory Traversal. There are two ways this vulnerability can be leveraged: When sharing a File System directory as in: assets"/static/", Paths.get"static" The class path...

PayloadsAllTheThings

This is a collection of security-related tools and resources, including a list of useful payloads and bypass techniques for web application security and penetration testing/CTF Capture The Flag. The repository includes tools such as Pacu, an AWS exploitation framework, and Bucket Finder, a tool f...

FreeRDP Resource Management Error Vulnerability

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. FreeRDP Resource Management Error Vulnerability. The vulnerability stems from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or product. An attacker ca...

squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1142-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a stack...

The vulnerability of the ReadCUTImage function in the console-based image editing tool ImageMagick, related to the use of uninitialized resources, allows attackers to access confidential information or cause service failures.

The vulnerability of the ReadCUTImage function in the console-based ImageMagick graphics editor is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to gain access to confidential information or cause service failures...

libreoffice: Remote resources protection module not applied to bullet graphics

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...

Resource consumption vulnerability in giflib

giflib is a library for reading and writing gif images. A resource consumption vulnerability exists in giflib, which can be exploited by an attacker to consume system resources...

RHEL 7 : Satellite 6.7 . (Important) (RHSA-2020:1454)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1454 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...

Simplifying Data Center and IaaS Visibility and Protection

Helping customers further secure their on-premises data centers and IaaS deployments is an interesting new use case for our Enterprise Threat Protector service. Enterprises typically have a significant number of applications that are deployed and run in these environments. I'm using the word...

Information Disclosure

github.com/helm/helm is susceptible to information disclosure. When Helm template lookup function is run, it no longer restricts to not to make a call to the cluster during the helm template and helm install|update|delete|rollback --dry-run without any notification to the user, allowing it to che...

The vulnerability of Google Chrome, related to improper control of access to critical resources, allows a violator to gain unauthorized access.

The vulnerability of Google Chrome relates to improper control of access to a critical resource. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to information through a specially created HTML page...

The vulnerability of Firefox browser, related to the improper assignment of access rights for critical resources, allows attackers to gain unauthorized access to information.

The vulnerability of Firefox browsers is related to the improper assignment of access rights for critical resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information...

Squid Code Execution Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in versions of Squid prior to 5.0.2. An attacker can exploit the vulnerability by...