CVE-2020-13540

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the...

CVE-2020-13540

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the...

CVE-2020-28052

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

PT-2021-9622 · Unknown · Win-911 Enterprise

Name of the Vulnerable Software and Affected Versions: Win-911 Enterprise version 4.20.13 Description: A local privilege elevation issue exists due to file system permissions in the install directory, specifically via the WIN-911 Account Change Utility. This allows an attacker to overwrite...

CVE-2020-13540: Incorrect Default Permissions

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the...

CVE-2020-29478: Empty Password in Configuration File

CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition...

PT-2021-11672

Name of the Vulnerable Software and Affected Versions: CA Service Catalog versions 17.2 through 17.3 Description: The issue is related to a vulnerability in the default configuration of the Setup Utility, which may allow a remote attacker to cause a denial of service condition. Recommendations: F...

CVE-2020-27719

On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

CVE-2020-27719

On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

Cross site scripting

On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

CVE-2020-27719: Improper Neutralization of Input During Web Page Generation

On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

PT-2020-16781

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.0 through 14.1.3 BIG-IP versions 15.1.0 through 15.1.0.5 BIG-IP versions 16.0.0 through 16.0.0.1 Description A cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility. This allows f...

Telerik Fiddler Code Injection Vulnerability

Telerik Fiddler is an HTTP protocol debugging proxy tool. A code injection vulnerability exists in Telerik Fiddler 5.0.20202.18177 and earlier versions, which allows an attacker to execute an arbitrary program via a hostname with a space character at the end, followed by the --utility-and-browser...

Broadcom CA Service Catalog Security Vulnerability

Broadcom CA Service Catalog is a service of Broadcom, Inc. designed to help you increase the value that IT delivers to your business and enable enterprise-class solutions that communicate service offerings in a way that users can understand. A vulnerability in the default configuration of the Set...

More on the SolarWinds Breach

The New York Times has more details. About 18,000 private and government users downloaded a Russian tainted software update -­ a Trojan horse of sorts ­- that gave its hackers a foothold into victims systems, according to SolarWinds, the company whose software was compromised. Among those who use...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K25691186)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.3.1 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K25691186 advisory. - On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via...

openscap bug fix and enhancement update

The OpenSCAP suite enables integration of the Security Content Automation Protocol SCAP line of standards. The openscap packages provide the OpenSCAP library and the oscap utility that provides various SCAP capabilities. Bug Fixes and Enhancements: Enable YAML probe to work with sets of values...

PT-2020-1235

Name of the Vulnerable Software and Affected Versions openscap affected versions not specified Description The issue concerns the OpenSCAP suite, which integrates the Security Content Automation Protocol SCAP line of standards. The openscap packages provide the OpenSCAP library and the oscap...

Linux sysctl hugetlbl Privilege Escalation

The vulnerability of the sysctl hugetlbl utility in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures or elevate privileges...

Spearphishing Attack Spoofs Microsoft.com to Target 200M Office 365 Users

A spearphishing attack is spoofing Microsoft.com to target 200 million Microsoft Office 365 users in a number of key vertical markets, including financial services, healthcare, manufacturing and utility providers. Researchers at Ironscales discovered the campaign targeting several thousand...