6428 matches found
Vulntober: Multiple Mobile Browser Address Bar Spoofing Vulnerabilities
Today, we're announcing a coordinated vulnerability disclosure publication with our longtime mobile hacker friend, Rafay Baloch. If you'd like to just jump straight to the technical details for these vulnerabilities, I invite you to read his paper here. If you want to know more about why this...
SSOAuth Code Execution
The vulnerability of the SSOAuth software component in the Senstar Symphony video surveillance management platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
CVE-2020-8929 Ciphertext integrity weakness in Tink
A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting...
CVE-2020-25214: Undefined Security Weakness
In the client in Overwolf 0.149.2.30, a channel can be accessed or influenced by an actor that is not an endpoint...
Cisco WebEx Meetings Template Rights
The vulnerability of the template creation function for Cisco Webex Meetings software-related web conferencing solutions is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain permission to create meeting templates...
CVE-2020-4778
IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156...
CVE-2020-26916: Undefined Security Weakness
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 befor...
Cisco IOS XE CAPWAP DoS
The vulnerability of the Control and Provisioning of Wireless Access Points CAPWAP implementation for the Cisco IOS XE operating system on Cisco Catalyst 9800 Series network devices is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to...
CVE-2020-7742: Undefined Security Weakness
This affects the package simpl-schema before 1.10.2...
DEBIAN-CVE-2020-7069
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data...
CVE-2020-25017: Undefined Security Weakness
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...
SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration
SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration Weakness Vendor: SpinetiX AG Product web page: https://www.spinetix.com Affected version: Username...
SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration
Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration Date: 2020-09-30 Exploit Author: LiquidWorm Vendor Homepage: https://www.spinetix.com Version: = 8.2.26 SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration Weakness Vendor: SpinetiX AG Product web page:...
RoundCube wash_uri function Heap Buffer Overflow
The vulnerability of the washuri function in the RoundCube Webmail client is related to deficiencies in the security measures used to protect website structures. Exploiting this vulnerability allows an attacker to compromise the integrity of data...
JunOS SRX DoS
The vulnerability of JunOS operating system’s High-End SRX series routers exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
Intel Converged Security DoS
The vulnerability of the Intel Converged Security and Manageability Engine implementation exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...
CVE-2020-13321: Undefined Security Weakness
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added...
MGASA-2020-0370 Updated mbedtls packages fix security vulnerabilities
mbedtls 2.16.8 fixes three security vulnerabilities which could affect earlier releases: Local side channel attack on classical CBC decryption in DTLS CVE-2020-16150. Local side channel attack on RSA and static Diffie-Hellman. Protocol weakness in DHE-PSK key exchange...
