‼ CVE-2020-28055 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27146 ‼
📖 Read
via "National Vulnerability Database".
The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the affected system. A successful attack using this vulnerability requires human interaction from an authenticated user other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser): versions 11.6.0 and below.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26810 ‼
📖 Read
via "National Vulnerability Database".
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6316 ‼
📖 Read
via "National Vulnerability Database".
SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26808 ‼
📖 Read
via "National Vulnerability Database".
SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26819 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that allows them to read and delete database logfiles because of Improper Access Control.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26815 ‼
📖 Read
via "National Vulnerability Database".
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26814 ‼
📖 Read
via "National Vulnerability Database".
SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26817 ‼
📖 Read
via "National Vulnerability Database".
SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27403 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network, can download most system files, leading to serious critical information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26809 ‼
📖 Read
via "National Vulnerability Database".
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25074 ‼
📖 Read
via "National Vulnerability Database".
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26818 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which reveals sensitive system information that would otherwise be restricted to highly privileged users because of missing authorization, resulting in Information Disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26822 ‼
📖 Read
via "National Vulnerability Database".
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery Configuration Service, this has an impact to the integrity and availability of the service.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26821 ‼
📖 Read
via "National Vulnerability Database".
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter Service, this has an impact to the integrity and availability of the service.📖 Read
via "National Vulnerability Database".
🕴 Cloud Usage, Biometrics Surge As Remote Work Grows Permanent 🕴
📖 Read
via "Dark Reading".
A new report reveals organizations are increasing their adoption of biometric authentication and disallowing SMS as a login method.📖 Read
via "Dark Reading".
Dark Reading
Cloud Usage, Biometrics Surge As Remote Work Grows Permanent
A new report reveals organizations are increasing their adoption of biometric authentication and disallowing SMS as a login method.
🔏 New Government Contractor Cybersecurity Requirements Loom 🔏
📖 Read
via "Digital Guardian".
A new cybersecurity rule will go into effect for DoD contractors at the end of the month to enhance the protection of unclassified information within the supply chain.📖 Read
via "Digital Guardian".
Digital Guardian
New Government Contractor Cybersecurity Requirements Loom
A new cybersecurity rule will go into effect for DoD contractors at the end of the month to enhance the protection of unclassified information within the supply chain.
❌ Scalper-Bots Shake Down Desperate PS5, Xbox Series X Shoppers ❌
📖 Read
via "Threat Post".
Retail bots are helping scalpers scoop up PS5, Xbox Series X inventory and charge massive markups.📖 Read
via "Threat Post".
Threat Post
Scalper-Bots Shake Down Desperate PS5, Xbox Series X Shoppers
Retail bots are helping scalpers scoop up PS5, Xbox Series X inventory and charge massive markups.
❌ Colossal Intel Update Anchored by Critical Privilege-Escalation Bugs ❌
📖 Read
via "Threat Post".
Intel released 40 security advisories in total, addressing critical- and high-severity flaws across its Active Management Technology, Wireless Bluetooth and NUC products.📖 Read
via "Threat Post".
Threat Post
Colossal Intel Update Anchored by Critical Privilege-Escalation Bugs
Intel released 40 security advisories in total, addressing critical- and high-severity flaws across its Active Management Technology, Wireless Bluetooth and NUC products.
‼ CVE-2020-28368 ‼
📖 Read
via "National Vulnerability Database".
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-7357 ‼
📖 Read
via "National Vulnerability Database".
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.📖 Read
via "National Vulnerability Database".