Ransomware Attacks Hit Major Utilities

Two state-owned utility companies in Brazil suffered separate ransomware attacks in the past week, forcing them to shut down some operations and services temporarily, In one case, sensitive data was stolen and dumped online, including network access logins and engineering plans. Centrais Eletrica...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

This repository is an offensive tool for a vulnerability hub. It contains various tools and exploits for testing and demonstrating vulnerabilities in different software and systems. The repository includes a range of tools, such as Docker image builders, format checkers, and Markdown linters, as...

Hunting for Bugs in Windows Mini-Filter Drivers

Posted by James Forshaw, Project Zero In December Microsoft fixed 4 issues in Windows in the Cloud Filter and Windows Overlay Filter WOF drivers CVE-2020-17103, CVE-2020-17134, CVE-2020-17136, CVE-2020-17139. These 4 issues were 3 local privilege escalations and a security feature bypass, and the...

The vulnerability of the nsm DropPrivileges function (from the support/nsm.File.c module in the NFS utilities nfs-utils package) arises from improper assignment of standard privileges. This allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the nsm DropPrivileges function from the NFS utility package nfs-utils, file.c section is related to the improper assignment of standard privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data, compromise its...

USN-4649-2 xdg-utils regression

USN-4649-1 fixed vulnerabilities in xdg-utils. That update caused a regression by removing the --attach functionality in thunderbird and others applications. This update fix the problem by reverting these changes. Original advisory details: Jens Mueller discovered that xdg-utils incorrectly handl...

DEBIAN-CVE-2020-35495

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Synergy

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.40 and Version 8.0.5.35 used by Rational Synergy versions 7.2.1.0 to 7.2.1.7. Rational Synergy has addressed the applicable CVEs. Vulnerability Details Rational Synergy has addressed the following: If...

Prototype Pollution in yowainwright/common-utilities

Description @common-utilities/merge-objects is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var a = require"@common-utilities/merge-objects" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " +...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4782)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

CVE-2020-27730

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...

CVE-2020-27730

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...

Code injection

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...

PT-2020-5282 · Nginx · Nginx Controller Agent

Name of the Vulnerable Software and Affected Versions: NGINX Controller Agent versions 1.0.1, 2.0.0 through 2.9.0, 3.0.0 through 3.9.0 Description: The issue is related to the NGINX Controller Agent's failure to use absolute paths when calling system utilities, which can be exploited by a remote...

USN-4649-1 xdg-utils vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information...

xdg-utils Security Vulnerabilities

Freedesktop Xdg-utils is a software from the Xdg organization that provides integrated functionality for desktop systems. A security vulnerability exists in xdg-utils that can be exploited by an attacker to bypass access restrictions to xdg-utils data in order to obtain sensitive information...

The vulnerability of the System Wide Java environment for creating, integrating, and managing applications within the Oracle Utilities Framework allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the System Wide Java environment used for creating, integrating, and managing applications within the Oracle Utilities Framework is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information, o...

Cron Utils Injection Vulnerability

Cron Utils is a Java codebase for authenticating, parsing, and migrating Cron expressions from the individual developers at Jmrozanec. An injection vulnerability exists in Cron-utils versions prior to 9.1.3, which can be exploited by an attacker to be able to inject arbitrary Java EL expressions,...

RHEL 7 : procps-ng (RHSA-2020:1464)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1464 advisory. The procps-ng packages contain a set of system utilities that provide system information, including ps, free, skill, pkill, pgrep, snice, tload, top,...

Oracle Utilities Framework Licensing Issues Vulnerability

Oracle Utilities Framework is an application framework cumulative features tool from Oracle USA. The tool makes it easy to find features that have been added to an application between releases. An authorization issue vulnerability exists in the System Wide component of Oracle Utilities Framework...

Print Detective

Print Detective v1.2.1.5 Created Date: 5/21/2008 Updated Date: 6/2/2011 Please note: You can download the required file from the Citrix downloads website by visiting the following link: https://www.citrix.com/downloads/citrix-tools Description Print Detective is an information gathering utility...