CVE-2020-0419

In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2020-0419

CVE-2020-0419 involves Android’s PackageInstallerSession.java, where generateInfo can leak cross-profile URI data during app installation due to a missing permission check. The issue affects Android 8.1–11 and is described as local information disclosure with no authentication or user interaction...

CVE-2018-20243

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629...

October 13, 2020-KB4578974 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1903, Windows Server, version 1903, Windows 10, version 1909, and Windows Server, version 1909

None None...

Debian DLA-2405-1 : httpcomponents-client security update

Oleg Kalnichevski discovered that httpcomponents-client, a Java library for building HTTP-aware applications, can misinterpret a malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. For Debian 9 stretch,...

[SECURITY] [DLA 2405-1] httpcomponents-client security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2405-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 10, 2020 https://wiki.debian.org/LTS -...

CVE-2020-13956

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution...

Cross site request forgery (csrf)

PyroCMS 3.7 is vulnerable to cross-site request forgery CSRF via the admin/pages/delete/ URI: pages will be deleted...

CVE-2020-25262

PyroCMS 3.7 is vulnerable to cross-site request forgery CSRF via the admin/pages/delete/ URI: pages will be deleted...

CVE-2020-25262

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI, which can cause pages to be deleted. The issue is documented across multiple sources (e.g., NVD/Red Hat/OSV/GHSA) with CSRF as the root cause. No explicit exploit details or mitigations are provided in...

Student Result Management System 1.0 SQL Injection

Exploit Title: Student Result Management System 1.0 - Multiple SQL Injection Vulnerabilities Date: 2020-10-02 Exploit Author: b1nary Vendor Homepage: https://projectworlds.in/free-projects/php-projects/student-result-management-system-project-in-php/ Software Link:...

Spammers Smuggle LokiBot Via URL Obfuscation Tactic

Spammers have started using a tricky URL obfuscation technique that sidesteps detection – and ultimately infects victims with the LokiBot trojan. The tactic was uncovered in recent spear-phishing emails with PowerPoint attachments, which contain a malicious macro. When the PowerPoint file is...

Address Bar Spoofing

WebKitGTK+ is vulnerable to address bar spoofing. An attacker could cause malicious web content to be displayed as if for a trusted URI...

ASB-A-142125338

In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

The vulnerability of the wash_uri function (rcube_washtml.php) in the RoundCube Webmail email client allows an attacker to compromise the integrity of data by exploiting vulnerabilities in the security measures protecting web page structures.

The vulnerability of the washuri function in the RoundCube Webmail client is related to deficiencies in the security measures used to protect website structures. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

CVE-2020-20800

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI...

CVE-2020-20800

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI...

Sql injection

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI...

CVE-2020-20800

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI...

Observium cross-site scripting vulnerability (CNVD-2020-62448)

Observium is a low-maintenance auto-discovery network monitoring platform that supports multiple device types, platforms and operating systems. Observium suffers from a cross-site scripting vulnerability. An attacker can exploit this vulnerability to inject and store malicious JavaScript code via...