CVE-2020-13863

The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information...

CVE-2020-13863

The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information...

Popular iOS SDK Accused of Spying on Billions of Users and Committing Ad Fraud

A popular iOS software development kit SDK used by over 1,200 apps—with a total of more than a billion mobile users—is said to contain malicious code with the goal of perpetrating mobile ad-click fraud and capturing sensitive information. According to a report published by cybersecurity firm Snyk...

Popular iOS SDK Accused of Spying on Billions of Users and Committing Ad Fraud

A popular iOS software development kit SDK used by over 1,200 apps—with a total of more than a billion mobile users—is said to contain malicious code with the goal of perpetrating mobile ad-click fraud and capturing sensitive information. According to a report published by cybersecurity firm Snyk...

(0Day) Horde Groupware Webmail Edition Ui generateUI Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Ui.php. The issue results from the lack of proper validation of user-supplie...

Parallels Desktop Integer Overflow Elevation of Privilege Vulnerability

Parallels Desktop is a virtual machine software that runs on Mac computers. An integer overflow elevation of privilege vulnerability exists in the prlhypervisor module in versions prior to Parallels Desktop 16.0.0 48916. The vulnerability stems from a lack of proper validation of user-supplied...

Zoom Faces More Legal Challenges Over End-to-End Encryption

Video-conferencing behemoth Zoom has been hit with yet another lawsuit stemming from its claim to offer end-to-end encryption for sessions. The suit, filed in a Washington D.C. court PDF this week by a nonprofit advocacy group called Consumer Watchdog, alleges that the company falsely told users...

23% of Tor browser relays found to be stealing Bitcoin

By Sudais Asif The threat actor was able to see the user's transmitted data on the Tor browser and tamper with it for their own ill-motives. This is a post from HackRead.com Read the original post: 23% of Tor browser relays found to be stealing Bitcoin...

CVE-2020-9528

Firmware developed by Shenzhen Hichip Vision Technology V6 through V20, as used by many different vendors in millions of Internet of Things devices, suffers from cryptographic issues that allow remote attackers to access user session data, as demonstrated by eavesdropping on user video/audio...

CVE-2020-9526

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising...

CVE-2020-16227

Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execut...

Input validation

Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execut...

PT-2020-14828 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: The issue arises from the processing of specially crafted project files that lack proper validation of user-supplied data, potentially leading to a type confusion...

PT-2020-14812 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: The issue arises from the processing of specially crafted project files that lack proper validation of user-supplied data. This can cause the system to write outside th...

Qualcomm MSM8909W Path Traversal Vulnerability

The Qualcomm MSM8909W is a central processing unit CPU product from Qualcomm Incorporated USA. A path traversal vulnerability exists in DSP Services in the Qualcomm MSM8909W, which stems from a lack of checks on user data. An attacker could exploit the vulnerability to overwrite or read arbitrary...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2020-51786)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft IE 11. The vulnerability can be exploited by an attacker to obtain a user's personal information by making ...

NETGEAR R6700 Buffer Overflow Vulnerability (CNVD-2020-43666)

The NETGEAR R6700 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the NETGEAR R6700 version V1.0.4.8410.0.58, which originates from a program failing to properly validate the length of user-submitted data before copying it to a heap-based fixed buffer. An attacker cou...

IBM MQ Appliance Information Disclosure Vulnerability (CNVD-2020-44874)

The IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM USA. An information disclosure vulnerability exists in IBM MQ Appliance version 8.0, 9.1 LTS version and 9.1 CD version, which originates from errors such as configuration during...

PlayStation: SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECK

Summary Memory corruption can be achieved by sending fragmented IPv6 packets to loopback interface due to poor and inconsistent use of IP6EXTHDRCHECK. The macro IP6EXTHDRCHECK can free the mbuf if the packet is sent to loopback interface. This fact is not considered in dest6input, frag6input and...

Unauthorized Access Vulnerability in Dolphin Notebook Order Android APP of Beijing Smooth Entertainment Technology Co.

Dolphin Bookkeeping App is a professional and simple mobile bookkeeping software. There is an unauthorized access vulnerability in Dolphin Bookkeeping App for Android, which can be exploited by attackers to obtain sensitive information...