CVE-2020-35693

On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy BLE device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offer...

Design/Logic Flaw

The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page...

CVE-2020-26270

In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer...

The vulnerability of the components term.arh and core.arh of the EKRA 200 microprocessor series allows a hacker to access confidential information and create new configuration files.

The vulnerability of the term.arh and core.arh components of the EKRA microprogramming system lies in the presence of pre-installed registration data. Exploiting this vulnerability can allow attackers to access confidential information and create new configuration files...

Information Disclosure

Libgcrypt is vulnerable to information disclosure. An attacker who learns the EdDSA session key can recover the long-term secret key...

Denial of Service Vulnerability in LTE Digital Cellular Mobile Network MME Devices (CNVD-2020-67628)

LTE digital cellular mobile communication network MME equipment is an important network element of LTE core network, which is responsible for processing signaling. A denial of service vulnerability exists in LTE Digital Cellular Mobile Communications Network MME devices. An attacker can exploit t...

GovRAT 2.0 - FUD unknown RAT with special functions

This RAT was written by me and cannot be blocked. FUD tested with the strictest firewall policies. You are buying the source code + digital certificate to sign your files. I can also host the C&C for you for extra Functions: Access C&C with any browser. Compile C&C for Linux OR Windows. VALID...

new module: perl:5.30

An update is available for perl-Pod-Perldoc, perl-DBI, perl-Pod-Escapes, perl-Devel-PPPort, perl-Pod-Usage, perl-Sub-Exporter, perl-perlfaq, perl-Object-HashBase, perl-CPAN-Meta-YAML, perl-Digest, perl-podlators, perl-bignum, perl-Text-ParseWords, perl-Text-Template, perl-DBD-MySQL, perl-Text-Glo...

jenkins: stored XSS vulnerability in project naming strategy

A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. The project naming strategy description, displayed on item creation, is not properly escaped. This can result in a stored cross-site scripting XSS vulnerability exploitable by users with Overall/Manage permissions. The highes...

Design/Logic Flaw

The Bluetooth Low Energy Secure Manager Protocol SMP implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-Hellman check during the Secure Connection pairing to be skipped if the Link Layer encryption setup is performed earlier. An attacker in radi...

CVE-2020-13593

The Bluetooth Low Energy Secure Manager Protocol SMP implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-Hellman check during the Secure Connection pairing to be skipped if the Link Layer encryption setup is performed earlier. An attacker in radi...

jenkins: Stored XSS vulnerability in 'keep forever' badge icons

A flaw was found in jenkins in versions prior to 2.244 and versions prior to LTS 2.235.1. Job names in the 'Keep this build forever' badge tooltip are not properly escaped which results in a stored cross-site scripting XSS vulnerability exploitable by users able to configure job names. The highes...

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

...

Vulnerabilities fixed in Apache HTTP server

Vulnerabilities have been fixed in Apache. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Access to sensitive data -= Ubuntu =- Canonical has...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2020-46299)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

August 11, 2020—KB4571694 (OS Build 14393.3866)

None None...

CloudBees Jenkins LTS Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

PT-2020-14549 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax dashboard.php file,...

June 18, 2020—KB4567517 (OS Build 14393.3755)

None None...

jenkins: CSRF protection bypass via crafted URLs

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL...