CVE-2020-5326: Missing Authentication for Critical Function

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

PT-2020-18402

Name of the Vulnerable Software and Affected Versions Dell Client platforms affected versions not specified Description A BIOS Setup configuration authentication bypass issue exists in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. This allows an attacker with physical...

(Pwn2Own) Samsung Galaxy S10 Call Control Setup Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy 10. User interaction is required to exploit this vulnerability in that the target must answer a phone call. The specific flaw exists within the Call Control Setup messages. The issue...

PT-2020-20335

Name of the Vulnerable Software and Affected Versions Samsung Galaxy S10 Firmware versions G973FXXS3ASJA, O8.x, P9.0, Q10.0 Description This issue allows remote attackers to execute arbitrary code on affected devices. The exploitation requires user interaction, specifically answering a phone call...

CVE-2020-8959

CVE-2020-8959 affects Western Digital WesternDigitalSSDDashboardSetup.exe prior to version 3.0.2.0 and is described as allowing DLL hijacking. The vulnerability arises from the installer’s handling of DLL loading, with impacts stated as high for confidentiality, integrity, and availability, and a...

SUSE-SU-2020:0413-1 Security update for enigmail

This update for enigmail fixes the following issues: enigmail was updated to 2.1.5: Security issue: unsigned MIME parts displayed as signed bsc1159973 Ensure that upgrading GnuPG 2.0.x to 2.2.x upgrade converts keyring format Make Enigmail Compatible with Protected-Headers spec, draft 2 enigmail...

CVE-2020-5326

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

InjuredAndroid - A Vulnerable Android Application That Shows Simple Examples Of Vulnerabilities In A CTF Style

A vulnerable Android application with ctf examples based on bug bounty findings, exploitation concepts, and pure creativity. Setup for a physical device 1. Download injuredandroid.apk from Github 2. Enable USB debugging on your Android test phone. 3. Connect your phone and your pc with a usb cabl...

CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities...

CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities...

CVE-2019-20401

The CVE-2019-20401 issue affects Atlassian Jira prior to version 8.5.2, where CSRF flaws in various installation setup resources allow an unauthenticated, remote attacker to configure a Jira instance that has not yet finished being installed. The vulnerable component is the installation/setup res...

PT-2020-10418

Name of the Vulnerable Software and Affected Versions Jira versions prior to 8.5.2 Description The issue concerns a Cross-site request forgery CSRF vulnerability that allows remote attackers to configure a Jira instance that has not yet finished being installed. This can be done by exploiting...

CVE-2019-20401: Cross-Site Request Forgery (CSRF)

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities...

CVE-2019-15617

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...

Project-Black - Pentest/BugBounty Progress Control With Scanning Modules

Scope control, scope scanner and progress tracker for easier working on a bug bounty or pentest project. What is this tool for? The tools encourages more methodical work on pentest/bugbounty, tracking the progress and general scans information. It can launch masscan nmap dirsearch amass patator...

kubernetes security update

kubernetes 1.12.10-1.0.10 - CVE-2019-16276 Kubernetes Vulnerabilities Allow Authentication Bypass, DoS 1.12.10-1.0.9 - Define rolling update for flannel 1.12.10-1.0.8 - Modify flannel/dashboard image tags to use images that have the cve fix kubeadm-ha-setup 0.0.2-1.0.68 - Pull image prior to upda...

Cross site scripting

Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the 1 customList%5B0%5D.value field in enginemanager/server/serversetup/editadv.htm of the Server Setup configuration or the 2 host field in enginemanager/jspringsecuritycheck of the login form. This issu...

Temporary User Profiles Received Instead of Citrix Profile Management Profiles

Citrix Profile Management has been installed and configured in the environment. A Citrix Profile Management Store has been setup for the users where their profiles should be stored. When a user logs in they are receiving a temporary windows user profile instead of a Citrix Profile Management...

CVE-2019-17102

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...

PT-2020-9874

Name of the Vulnerable Software and Affected Versions Bitdefender BOX 2 versions prior to 2.1.47.36 Description An exploitable command execution issue exists in the recovery partition due to a race condition in the /api/update setup API endpoint. This allows arbitrary execution of system commands...