cPanel Privilege Management Vulnerability

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in cPanel versions prior to 88.03, which stems from having weak privileges globally readable to t...

Basecamp: Information Disclosure of Garbage Collection Cycle

Hello, Upon enumerating a subdomain content I found a directory that discloses the duration of the garbage collection cycles. I think that these information should be kept private because public should not know information about the target application and how it operates or do its garbage...

OracleVM 3.4 : python (OVMSA-2020-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - Prefix dot in domain for proper subdomain validation C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2020-0036...

ISC BIND Zone Update Vulnerability (cve-2020-8624)

ISC BIND versions 9.9.12 to 9.9.13, 9.10.7 to 9.10.8, 9.11.3 to 9.11.21, 9.12.1 to 9.16.5, 9.17.0 to 9.17.3 as well as 9.9.12-S1 to 9.9.13-S1, 9.11.3-S1 to 9.11.21-S1 of the BIND 9 Supported Preview Edition are affected by a vulnerability. An authenticated, remote attacker who has been granted...

update-policy rules of type "subdomain" are enforced incorrectly

...

CVE-2020-8624 update-policy rules of type "subdomain" are enforced incorrectly

In BIND 9.9.12 - 9.9.13, 9.10.7 - 9.10.8, 9.11.3 - 9.11.21, 9.12.1 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.12-S1 - 9.9.13-S1, 9.11.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abu...

USN-4468-1 bind9 vulnerabilities

Emanuel Almeida discovered that Bind incorrectly handled certain TCP payloads. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2020-8620 Joseph Gullo discovered that Bind incorrectly handled...

USN-4468-1: Bind vulnerabilities

Emanuel Almeida discovered that Bind incorrectly handled certain TCP payloads. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2020-8620 Joseph Gullo discovered that Bind incorrectly handled...

ISC BIND update-policy Enforcement Vulnerability (CVE-2020-8624) - Windows

ISC BIND is prone to a vulnerability where update-policy rules of type Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

ISC BIND update-policy Enforcement Vulnerability (CVE-2020-8624) - Linux

ISC BIND is prone to a vulnerability where update-policy rules of type Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Avito: link.avito.ru - Bypass of restrictions on external links.

Hello Avito! On "link.avito.ru" subdomain of "www.avito.ru" attacker able to bypass restriction for dangerous external links via trusted domain google.com. This scenario may be also possible with all other trusted subdomains of avito such as "yandex.ru" and so on, but in this example i'm used...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

CVE-2020-5902-Scanner Automated F5 Big IP Remote Code Executio...

Acronis: Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across another subdomainwww.jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the www.jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F940499 Similar to the previou...

Acronis: Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F937948 jet.acronis.com CNAME pointed to...

openSUSE Security Update : opera (openSUSE-2020-949)

This update for opera fixes the following issues : - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 CVE-2020-6509 - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildViewviews::View, int - DNA-86122 Mac Some popover...

HawkScan - Security Tool For Reconnaissance And Information Gathering On A Website

Security Tool for Reconnaissance and Information Gathering on a website. python 2.x & 3.x This script use "WafW00f" to detect the WAF in the first step https://github.com/EnableSecurity/wafw00f This script use "Sublist3r" to scan subdomains https://github.com/aboul3la/Sublist3r This script use...

Mail.ru: Subdomain Takeover at analyticstest.geekbrains.ru

Unused analyticstest.geekbrains.ru subdomain was delegated to tilda.cc and not claimed...

Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover

Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...

A New Flaw In Zoom Could Have Let Fraudsters Mimic Organisations

In a report shared with The Hacker News, researchers at cybersecurity firm CheckPoint today disclosed details of a minor but easy-to-exploit flaw they reported in Zoom, the highly popular and widely used video conferencing software. The latest Zoom flaw could have allowed attackers mimic an...

SUSE SLES12 Security Update : bind (SUSE-SU-2020:1914-1)

This update for bind fixes the following issues : Amended documentation referring to rule types 'krb5-subdomain' and 'ms-subdomain'. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. CVE-2018-5741...