‼ CVE-2020-14188 ‼
📖 Read
via "National Vulnerability Database".
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28364 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4651 ‼
📖 Read
via "National Vulnerability Database".
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28371 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28373 ‼
📖 Read
via "National Vulnerability Database".
upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4759 ‼
📖 Read
via "National Vulnerability Database".
IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26168 ‼
📖 Read
via "National Vulnerability Database".
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14189 ‼
📖 Read
via "National Vulnerability Database".
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4650 ‼
📖 Read
via "National Vulnerability Database".
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.📖 Read
via "National Vulnerability Database".
❌ Microsoft Teams Users Under Attack in ‘FakeUpdates’ Malware Campaign ❌
📖 Read
via "Threat Post".
Microsoft warns that cybercriminals are using Cobalt Strike to infect entire networks beyond the infection point, according to a report.📖 Read
via "Threat Post".
Threat Post
Microsoft Teams Users Under Attack in ‘FakeUpdates’ Malware Campaign
Microsoft warns that cybercriminals are using Cobalt Strike to infect entire networks beyond the infection point, according to a report.
🕴 How Hackers Blend Attack Methods to Bypass MFA 🕴
📖 Read
via "Dark Reading".
Protecting mobile apps requires a multilayered approach with a mix of cybersecurity measures to counter various attacks at different layers.📖 Read
via "Dark Reading".
Dark Reading
How Hackers Blend Attack Methods to Bypass MFA
Protecting mobile apps requires a multilayered approach with a mix of cybersecurity measures to counter various attacks at different layers.
‼ CVE-2020-0447 ‼
📖 Read
via "National Vulnerability Database".
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168251617📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0451 ‼
📖 Read
via "National Vulnerability Database".
In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9 Android-8.0 Android-8.1Android ID: A-158762825📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0441 ‼
📖 Read
via "National Vulnerability Database".
In Message and toBundle of Notification.java, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service requiring a device reset to fix with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-158304295📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0448 ‼
📖 Read
via "National Vulnerability Database".
In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to track an account across devices, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-153995334📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0446 ‼
📖 Read
via "National Vulnerability Database".
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264528📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0409 ‼
📖 Read
via "National Vulnerability Database".
In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-156997193📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0449 ‼
📖 Read
via "National Vulnerability Database".
In btm_sec_disconnected of btm_sec.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution in the Bluetooth server with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.0 Android-8.1Android ID: A-162497143📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0454 ‼
📖 Read
via "National Vulnerability Database".
In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-161370134📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0443 ‼
📖 Read
via "National Vulnerability Database".
In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to local denial of service requiring factory reset to restore with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-152410253📖 Read
via "National Vulnerability Database".
‼ CVE-2020-0453 ‼
📖 Read
via "National Vulnerability Database".
In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-8.0 Android-8.1Android ID: A-159060474📖 Read
via "National Vulnerability Database".