VulnCheck KEV: CVE-2021-27562

Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure NS world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment NSPE handler mode. This vulnerability affects...

Security Bulletin: IBM Verify Gateway PAM components do not set restricted access permission for debug logs (CVE-2020-4405)

Summary To debug the IBM Verify Gateway IVG PAM components, customers can add "trace-file" parameters in the PAM configuration so that .log files are written to the /tmp directory. These debug logs potentially contain sensitive information, and yet they default to world readable. They should have...

Directory Traversal Vulnerability in Easy Control World

Easy Control World is an automation monitoring and information system platform created by Beijing Jiushi Yi Automation Software Co. A directory traversal vulnerability exists in Easy Control World. An attacker can exploit the vulnerability to download arbitrary files from the program installation...

Qualcom qseecom driver 安全漏洞

Qualcom qseecom driver is a kernel interface from Qualcom. It provides the kernel driver with a bridge between the userland Normal world and the Secure world. A security vulnerability exists in the qseecom driver, which arises from a potentially arbitrary memory corruption when updating a physica...

All Vulnerabilities for accessily.com Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| accessily.com ---|--- Open Bug Bounty...

Exploit Details Emerge for Unpatched Microsoft Bug

New details have emerged about an unpatched security vulnerability in Microsoft’s Internet Explorer that was recently used in a complex campaign against security researchers. A fresh analysis from 0patch offers further insight into where the bug exists and how it can be triggered in real-world...

All Vulnerabilities for trailblazer.to Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| trailblazer.to ---|--- Open Bug Bounty...

Valentine’s Day Malware Attack Mimics Flower Store

With Valentine’s Day approaching this weekend, several people have received “recent order” email confirmations for flowers or lingerie. These emails are actually part of a spear-phishing attack, which ultimately leads recipients to a malicious document that executes the BazaLoader malware. The...

Debian DSA-4850-1 : libzstd - security update

It was discovered that zstd, a compression utility, temporarily exposed a world-readable version of its input even if the original file had restrictive permissions. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

[SECURITY] [DSA 4850-1] libzstd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4850-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 10, 2021 https://www.debian.org/security/faq -...

CVE-2021-23331

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file...

CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

'2034: A Novel of the Next World War,' an Exclusive Excerpt

What if things escalated? What if communications were knocked out? What if cyberwar was just the start? A note about this special six-part series...

Medium: targetcli

Issue Overview: An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup...

Unauthorized Access Vulnerability in Website Building System of Beijing North South World Technology Co.

hereinafter referred to as: North South Company was founded in 1994, is a new three board listed company stock code: 430066. It has been focusing on the foreign trade industry, providing enterprise users with "foreign trade ERP system", "foreign trade CRM system" and informationization services...

CVE-2020-6024

Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable to a possible local privilege escalation due to running executables from a directory with write access to all authenticated users...

My world has a dll hijacking vulnerability

My World is a free to build sandbox game. A dll hijacking vulnerability exists in My World. An attacker can exploit this vulnerability to execute malicious code...

CVE-2020-25507

An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions 0777...

Code injection

An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions 0777...

IMChecker

It is an offensive tool for API-misuse detection. The repository, kangleli/IMChecker, is a tool for detecting API-misuse bugs in C programs. It is a static analysis tool that uses a domain-specific language DSL called IMSpec to specify API usage constraints. The tool is designed to identify...