KLA12038 SUI vulnerability in Microsoft Azure

A spoofing vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2021-1677 Related products Microsoft-Azure CVE list CVE-2021-1677 high KB list Solution Install necessary updates from the KB section, that are...

Code injection

Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page...

Hostname spoofing via backslashes in URL

Overview URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library...

KLA12035 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in autofill component can be...

CVE-2020-5361

Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not...

Medialize urijs input validation error vulnerability

urijs is a Javascript URL mutation library. An input validation error vulnerability exists in urijs that stems from allowing hostname spoofing through the use of a backslash character followed by an at @ character. If a hostname is used in a security decision, the decision may be incorrect...

GHSA-3329-PJWV-FJPG Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may...

CVE-2020-26291 Hostname spoofing in URI.js

URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

Pivotal RabbitMQ < 3.3.4 Security Bypass Vulnerability

According to its self-reported version, the version of Pivotal RabbitMQ running on the remote web server is prior to 3.3.4. It is, therefore, affected by security bypass vulnerability. An unauthenticated, remote attacker could bypass security restrictions, caused by the improper handling of...

The vulnerability of Microsoft Excel spreadsheet editors and the Microsoft 365 Apps for Enterprise suite, related to access control deficiencies, allows attackers to bypass existing security measures.

The vulnerability of Microsoft Excel spreadsheet editors and the Microsoft 365 Apps for Enterprise suite is related to deficiencies in access control. Exploiting this vulnerability could allow a perpetrator to bypass existing security measures...

Arteco Web Client DVR/NVR 'SessionId' Cookie Brute Force Session Hijacking Exploit

Summary Arteco DVR/NVR is a mountable industrial surveillance server ideal for those who need to manage IP video surveillance designed for medium to large installations that require high performance and reliability. Arteco can handle IP video sources from all major international manufacturers and...

U.S. General Services Administration: Unauthorized access to employee panel with default credentials.

Summary: Hello, When hunting for your web application. I have managed to go https://cars.fas.gsa.gov/cars/cars and get displayed with a form. I have already tried to login to Cars and without success. However i've noticed the loginChk function and change the value of the form hence bypassing it a...

WordPress Contact Form 7 5.3.1 Shell Upload

Exploit Title: Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload Date: 12/20/2020 Exploit Author: Ramón Vila Ferreres @ramonvfer Vendor Homepage: https://contactform7.com Software Link: https://wordpress.org/plugins/contact-form-7/ Version: 5.3.1 and below Tested on: Windows 10 190...

Vulnerabilities fixed in LogRhythm SIEM

Vulnerabilities have been fixed in LogRhythm SIEM. The vulnerabilities allow a malicious person to conduct attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Circumvention of security measure. Remote code execution Administrator/Root...

Vulnerabilities fixed in Red Hat Openshift Container

Vulnerabilities have been fixed in Red Hat Openshift Container Platform. The vulnerability with reference CVE-2020-8559 allows an authenticated malicious person with root privileges on a node to be able to gain elevated privileges on other nodes running in the same cluster running. With these...

Vulnerability fixed in IBM Tivoli Netcool Impact

A vulnerability has been fixed in IBM Tivoli Netcool Impact. A malicious party can exploit the vulnerability to circumvent bypass security measures and obtain sensitive data via phishing. sensitive data. IBM has released updates to fix the vulnerability in Tivoli Netcool Impact 7.1.0.20. For more...

IBM Tivoli Netcool Impact Reverse Tag Phishing Attack Vulnerability

IBM Tivoli Netcool Impact simplifies event and alert management, business service management, and incident and problem management by providing context-driven correlation, intelligence, and automation capabilities. IBM Tivoli Netcool Impact 7.1.0.0 - 7.1.0.19 Interim Fix 7 is vulnerable to a rever...

CVE-2020-4849

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 190294...

Security feature bypass

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 190294...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to the bypassing of security features, allowing attackers to escalate their privileges.

The vulnerability of PDF viewer applications such as Adobe Reader and Document Cloud, as well as Adobe Acrobat and Document Cloud’s PDF editing programs, relates to bypassing security features. Exploiting this vulnerability allows a malicious actor to enhance their privileges in the context of th...