|
Il Thesaurus offre una rappresentazione della conoscenza di un insieme di termini relativi alla Cybersecurity,... |
Il servizio offre uno strumento semplice e rapido per l'autovalutazione per il calcolo del rischio cibernetico. Il... |
Un’ontologia rappresenta una risorsa per organizzare la conoscenza di un dominio in maniera più dettagliata attraverso... |
Servizio Rilevazione Malware. Il servizio permette di rilevare comportamenti malevoli in file (ad esempio, eseguibili o... |
| Published | Description | |
|---|---|---|
| CVE-2017-18112 |
05-08-2020 04:15:00 |
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3. |
| CVE-2020-15109 |
04-08-2020 23:15:00 |
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section. |
| CVE-2020-15135 |
04-08-2020 21:15:00 |
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7. |
| CVE-2020-16847 |
04-08-2020 21:15:00 |
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887. |
| CVE-2020-15943 |
04-08-2020 20:15:00 |
An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attacker has to be authenticated. |
| Date | Title | Platform | Author |
|---|---|---|---|
|
04-08-2020 |
Pi-hole 4.3.2 - Remote Code Execution (Authenticated) | python | Luis Vacacas |
|
04-08-2020 |
Daily Expenses Management System 1.0 - 'username' SQL Injection | php | Daniel Ortiz |
|
04-08-2020 |
RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC) | windows | Luis Martínez |
|
04-08-2020 |
Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC) | windows | Luis Martínez |
|
30-07-2020 |
Online Shopping Alphaware 1.0 - Authentication Bypass | php | Ahmed Abbas |
| Published | Title | URL |
|---|---|---|
| 05-05-2020 | Aggiornamento di sicurezza Android (maggio 2020) | CERT LINK |
| 04-05-2020 | Grave vulnerabilità in Cisco IOS XE SD-WAN Software | CERT LINK |
| 04-05-2020 | Risolte sette vulnerabilità in WordPress 5.4.1 | CERT LINK |
| 30-04-2020 | Aggiornamenti di sicurezza critici per Adobe Bridge, Illustrator e Magento | CERT LINK |
| 30-04-2020 | Grave vulnerabilità di tipo XSS in VMware ESXi | CERT LINK |
Italiano
English