CVE-2020-13336

Removed by vendor...

CVE-2020-13336

CVE-2020-13336 affects GitLab versions 11.8 up to, but not including, 12.10.13. The issue is a stored XSS via the error tracking feature. Multiple connected sources confirm the affected range and the vulnerability class. The documents do not provide exploitation details or a disclosed remediation...

CVE-2020-25830

CVE-2020-25830 affects MantisBT before 2.24.3. The root cause is improper escaping of a custom field name, permitting HTML injection and, if CSP allows, arbitrary JavaScript execution when updating that custom field via bug_actiongroup_page.php. Evidence in multiple sources ties this to an XSS ri...

SAS@Home is back this fall

The world during the pandemic prepares many surprises for us. Most of them are certainly unpleasant: health risks, inability to travel or meet old friends. One of these unpleasant surprises awaited us in the early spring, when the organizing team of the beloved SAS conference were forced to...

PT-2020-13477 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.8 through 12.10.13 Description: An issue has been discovered in GitLab, where it was vulnerable to a stored XSS in the error tracking feature. Recommendations: For versions 11.8 through 12.10.13, update to version 12.10.13 ...

kernel: memory corruption in Voice over IP nf_conntrack_h323 module

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this...

CVE-2020-13319

Removed by vendor...

Two major flight tracking services hit by crippling cyberattacks

By Waqas It is still unclear who is behind these cyberattacks however both Flightradar24 and PlaneFinder suffered major service disruption after the attacks. This is a post from HackRead.com Read the original post: Two major flight tracking services hit by crippling cyberattacks...

PT-2020-13460 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.2 GitLab versions prior to 13.0.8 GitLab versions prior to 12.10.13 Description: An issue has been discovered in GitLab where a missing permission check allows adding time spent on an issue. Recommendations: For...

CVE-2020-3569

creationtimestamp| type| source ---|---|--- 2020-09-27 13:56:54+00:00| seen| https://t.me/cKure/2395 2020-09-30 18:57:37+00:00| exploited| https://t.me/thehackernews/861 2020-09-30 19:13:34+00:00| exploited| https://t.me/YemenShield/514 2021-11-08 08:58:17+00:00| seen|...

The Best Chrome Extensions to Prevent Creepy Web Tracking

Ad trackers follow you everywhere online—but it doesn’t have to be that way...

Input validation

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance ESA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the...

CVE-2019-1983 Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance ESA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the...

CVE-2020-17506

creationtimestamp| type| source ---|---|--- 2020-09-21 20:38:44+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/articaproxyauthbypassservicecmdspeformcommandinjection.rb 2024-11-14 06:07:09+00:00| seen| MISP/c5be76fc-667f-4614-a326-c9b2726c0902...

Companies Can Track Your Phone’s Movements to Target Ads

Brands are seeking new ways to customize messages. A startup that gathers data on when you pick up your phone, or when you go out on a run, can help...

Charities and the advertising industry: data ecosystems and privacy risks

Data makes the world go round, more often than not via advertising and its tracking mechanisms. Whether you think making money from large volumes of PII to keep the web ticking over is a good thing, or a sleazy data-grab often encouraging terrible ad practices, it’s not going to go away anytime...

Google Play Bans Stalkerware and 'Misrepresentation'

Google is taking the step of prohibiting “stalkerware” in Google Play, along with apps that could be used in political-influence campaigns. Effective October 1, apps that would allow someone to surreptitiously track the location or online activity of another person will be removed from the intern...

Malicious Package in equest

All versions of equest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

GHSA-MVCH-RH6H-2M47 Malicious Package in equest

All versions of equest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

GHSA-R863-P739-275C Malicious Package in reuest

All versions of reuest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...