4774 matches found
Patch Tuesday, Good Riddance 2020 Edition
Microsoft today issued its final batch of security updates for Windows PCs in 2020, ending the year with a relatively light patch load. Nine of the 58 security vulnerabilities addressed this month earned Microsofts most-dire "critical" label, meaning they can be abused by malware or miscreants to...
PT-2020-5214 · Microsoft · Office Excel
Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to a security feature bypass in Microsoft Excel, which is associated with access control weaknesses. This can allow an attacker to bypass existing protection...
Android Messenger App Still Leaking Photos, Videos
The GO SMS Pro Android app has published two new versions on Google Play since a major security weakness was disclosed in November – but neither fixes the original issue, leaving 100 million users at risk for privacy violations, researchers said. Meanwhile, a raft of exploitation tools have been...
USN-4655-1 python-werkzeug vulnerabilities
It was discovered that Werkzeug has insufficient debugger PIN randomness. An attacker could use this issue to access sensitive information. This issue only affected Ubuntu 18.04 LTS. CVE-2019-14806 It was discovered that Werkzeug incorrectly handled certain URLs. An attacker could possibly use th...
The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information usin...
The vulnerability of the Intel Endpoint Management Assistant cloud service lies in the insufficient protection of registration data, allowing an intruder to gain unauthorized access to protected information.
The vulnerability of the Intel Endpoint Management Assistant cloud service is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the Windows Update Orchestrator Service component on the Windows operating system, which allows a malicious individual to escalate their privileges
The vulnerability of the Windows Update Orchestrator Service component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the WalletService service on Windows operating systems allows a perpetrator to escalate their privileges.
The vulnerability of the WalletService service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
BSA-2020-1158
Security Advisory ID : BSA-2020-1158 Component : LDAP Revision : 1.0 Brocade Fabric OS before v9.0.0 and afterv8.1.0, configured in Virtual Fabric mode contains a weakness in the ldap implementation that could allowa remote ldap user to login in the Brocade Fibre Channel SAN switch with "user"...
CVE-2020-7565
A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller...
UBUNTU-CVE-2020-28924
An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...
GO SMS Pro Android App Exposes Private Photos, Videos and Messages
A security weakness discovered in the GO SMS Pro Android app can be exploited to publicly expose media sent using the app, according to researchers. The GO SMS Pro application is a popular messenger app with more than 100 million downloads from the Google Play store. Researchers at Trustwave...
Cisco IoT Field Network Director SQL Injection Vulnerability
Cisco IoT Field Network Director IoT-FND is an end-to-end IoT management system from Cisco USA. The system features device management, asset tracking and smart metering. Cisco IoT Field Network Director suffers from a SQL injection vulnerability that results from insufficient input validation of...
The vulnerability of the `shaderGenerateMain` function in the Core component of the Oracle VM VirtualBox software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the shaderGenerateMain function in the Core component of the Oracle VM VirtualBox software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability of Intel microprogramming software, related to deficiencies in access control, allows attackers to enhance their privileges.
The vulnerability of Intel microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
In-band Protocol Negotiation And Robustness Weakness
aws-encryption-sdk suffers from an In-band protocol negotiation and robustness weakness. The SDK allows a unique ciphertext to be decrypted into different results due to the non-committing property of AES-GCM, and other AEAD ciphers such as AES-GCM-SIV, or XChaCha20Poly1305, when encrypting...
The vulnerability of the Windows Update Medic Service component on the Windows operating system, which allows a hacker to increase their privileges
The vulnerability of the Windows Update Medic Service component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the command-line interface (CLI) of the programmatically defined Cisco SD-WAN network allows a attacker to increase their privileges.
The vulnerability of the command-line interface CLI of Cisco SD-WAN software-defined networks is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software platform allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP...