BlueZ Access Control Error Vulnerability

BlueZ is a Bluetooth protocol stack written in C. It is primarily used to provide support for the core Bluetooth layers and protocols. An Access Control Error vulnerability exists in subsystems in BlueZ versions prior to 5.54. The vulnerability arises from a network system or product not properly...

CVE-2020-6209

SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check...

CVE-2020-9454

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...

CVE-2020-8812

Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...

Code injection

Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

Privilege Escalation

plone.restapi is vulnerable to privilege escalation. The vulnerability exists as DeserializeFromJson does not properly delegate the allowed user roles...

LOLBITS - C# Reverse Shell Using Background Intelligent Transfer Service (BITS) As Communication Protocol

LOLBITS is a C reverse shell that uses Microsoft's Background Intelligent Transfer Service BITS to communicate with the Command and Control backend. The Command and Control backend is hidden behind an apparently harmless flask web application and it's only accesible when the HTTP requests receive...

Rethinking cyber scenarios—learning (and training) as you defend

In two recent posts I discussed with Circadence the increasing importance of gamification for cybersecurity learning and how to get started as a practitioner while being supported by an enterprise learning officer or security team lead. In this third and final post in the series, Keenan and I...

CVE-2018-3279

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Roles. Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3074

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Roles. Supported versions that are affected are 8.0.11 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

Samsung J7 Neo Access Control Error Vulnerability (CNVD-2020-14680)

Samsung J7 Neo is a smartphone from Samsung South Korea. The Samsung J7 Neo build fingerprint: samsung/j7velteub/j7velte:8.1.0/M1AJQ/J701MUBS6BSB4:user/release-keys in the com.samsung.android. An access control error vulnerability exists in the themecenter app. The vulnerability stems from the...

Samsung J4 Access Control Error Vulnerability

The Samsung J4 is a smartphone from the South Korean company Samsung Samsung. An access control error vulnerability exists in the Samsung J4. The vulnerability stems from a network system or product not properly restricting access to resources from unauthorized roles. An attacker could exploit th...

Samsung J7 Pro Access Control Error Vulnerability (CNVD-2020-14792)

The Samsung J7 Pro is a smartphone from the South Korean company Samsung Samsung. An access control error vulnerability exists in the Samsung J7 Pro. The vulnerability stems from the network system or product not properly restricting access to resources from unauthorized roles. An attacker could...

Haier G8 Access Control Error Vulnerability

Haier G8 is a smartphone from the Chinese company Haier. An access control error vulnerability exists in the Haier G8. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the vulnerability...

Elephone A4 Access Control Error Vulnerability

Elephone A4 is a smartphone from China's ELEPHONE Communication Technology. An Access Control Error vulnerability exists in the Elephone A4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles and can be exploited b...

Samsung S7 Edge Access Control Error Vulnerability

Samsung S7 Edge is a smartphone from the South Korean company Samsung Samsung. An access control error vulnerability exists in Samsung S7 Edge. The vulnerability stems from the network system or product not properly restricting access to resources from unauthorized roles. An attacker could exploi...

Download: The 2020 Cybersecurity Salary Survey Results

The 2020 Cybersecurity Salary Survey was an online survey published in The Hacker News and created to provide insight into the details related to cybersecurity compensation. There were over 1,500 security professionals who completed the survey. Today you can access the aggregated and analyzed 202...

[SECURITY] Fedora 31 Update: freeipa-4.8.3-1.fc31

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

The Hacker News 2020 Cybersecurity Salary Survey – Call for Participation

For the first time, The Hacker News launches a comprehensive Cybersecurity Salary Survey aimed to provide insights into the payment standards of security positions, enabling security professionals to benchmark their salaries against their peers, as well as get clear insights into the leading role...