Microsoft ChakraCore Remote Code Execution Vulnerability (CNVD-2020-72701)

Microsoft ChakraCore is an open source ChakraJavaScript scripting engine used by Microsoft in the Edge browser, or as a stand-alone JavaScript engine. A remote code execution vulnerability exists in Microsoft ChakraCore. The vulnerability stems from a lack of authentication measures or insufficie...

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

...

The vulnerability of the Cisco Smart Software Manager On-Premium license management software, related to deficiencies in access control, allows a perpetrator to increase their privileges.

The vulnerability of the Cisco Smart Software Manager On-Prem licensing management software is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

GHSA-2R7F-4H2C-5X73 fury-adapter-swagger allows arbitrary file read from system

fury-adapter-swagger from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like /dev/zero. Proof of Concept: yaml -...

API Admin Auth Weakness in tomato

Versions of tomato prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that...

CVE-2020-4603

CVE-2020-4603 affects IBM Security Guardium Insights 2.0.1, where an operation is performed at a privilege level higher than the minimum required, potentially amplifying other weaknesses (IBM X-Force ID 184880). The IBM bulletin for Guardium Insights lists this among multiple vulnerabilities and ...

A Google Drive 'Feature' Could Let Attackers Trick You Into Installing Malware

An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate. The latest security issue—of which Google...

CVE-2020-16239

When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct...

2020 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2020 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The Top 25 uses data from the National Vulnerability...

GHSA-9XGP-HFW7-73RQ Authentication Weakness in keystone

There is an authentication weakness vulnerability in keystone before version 0.3.16. Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in...

The vulnerability in webmail for AJAX Roundcube-based IMAP servers relates to deficiencies in the security measures used to protect website structures. This vulnerability allows attackers to compromise data integrity.

The vulnerability of webmail for IMAP servers based on AJAX Roundcube is related to deficiencies in the security measures used to protect website structures. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

CVE-2020-8210

Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account...

PT-2020-6900 · Apache +2 · Apache Shiro +2

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.6.0 Description: The issue is related to weaknesses in the authentication procedure of the Apache Shiro framework. It may allow a remote attacker to bypass existing security restrictions by sending a specially...

ETCD Authorization Issues Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. An authorization issue vulnerability exists in etcd versions prior to 3.4.10 and prior to 3.3.23. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a...

The vulnerability of the BI Publisher Security component of the Oracle BI Publisher reporting tool allows a perpetrator to perform a cross-site scripting attack.

The vulnerability of the BI Publisher Security component of the Oracle BI Publisher reporting tool relates to the lack of security measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, related to access control deficiencies, allows attackers to increase their privileges.

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to increase their privileges...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the mechanism for checking SCTP fragments in WebRTC browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SCTP fragment checking mechanism in WebRTC browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability can allow an attacker to gain access to confidentia...

The vulnerability in the web interface of the Cisco Data Center Network Manager system allows a hacker to escalate their privileges.

The vulnerability of the Web interface of the Cisco Data Center Network Manager DCNM system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to increase their privileges through a specially crafted request...

The vulnerability of the Expenses component in the PeopleSoft Enterprise FIN Expenses business application suite allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the Expenses component in the PeopleSoft Enterprise FIN Expenses business application is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information or to modify,...