‼ CVE-2020-28368 ‼
📖 Read
via "National Vulnerability Database".
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-7357 ‼
📖 Read
via "National Vulnerability Database".
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23968 ‼
📖 Read
via "National Vulnerability Database".
Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\000-sngWSService1.log.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27165 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-28050. Reason: This candidate is a reservation duplicate of CVE-2020-28050. Notes: All CVE users should reference CVE-2020-28050 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
❌ Microsoft Patch Tuesday Update Fixes 17 Critical Bugs ❌
📖 Read
via "Threat Post".
Remote code execution vulnerabilities dominate this month’s security bulletin of warnings and patches.📖 Read
via "Threat Post".
Threat Post
Microsoft Patch Tuesday Update Fixes 17 Critical Bugs
Remote code execution vulnerabilities dominate this month’s security bulletin of warnings and patches.
🕴 Microsoft Patches Windows Kernel Flaw Under Active Attack 🕴
📖 Read
via "Dark Reading".
This month's Patch Tuesday addressed a Windows zero-day in a release of 112 vulnerabilities, 17 of which are critical.📖 Read
via "Dark Reading".
Darkreading
Microsoft Patches Windows Kernel Flaw Under Active Attack
This month's Patch Tuesday addressed a Windows zero-day in a release of 112 vulnerabilities, 17 of which are critical.
🕴 Claroty Details Vulnerabilities in Schneider PLCs 🕴
📖 Read
via "Dark Reading".
The vulnerabilities in a common line of programmable logic controllers could allow attackers to gain control of industrial equipment.📖 Read
via "Dark Reading".
Dark Reading
Claroty Details Vulnerabilities in Schneider PLCs
The vulnerabilities in a common line of programmable logic controllers could allow attackers to gain control of industrial equipment.
‼ CVE-2020-25268 ‼
📖 Read
via "National Vulnerability Database".
Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25267 ‼
📖 Read
via "National Vulnerability Database".
An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28408 ‼
📖 Read
via "National Vulnerability Database".
The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28409 ‼
📖 Read
via "National Vulnerability Database".
The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24367 ‼
📖 Read
via "National Vulnerability Database".
Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that is later executed by a higher-privileged user.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24063 ‼
📖 Read
via "National Vulnerability Database".
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.📖 Read
via "National Vulnerability Database".
🕴 Malware Hidden in Encrypted Traffic Surges Amid Pandemic 🕴
📖 Read
via "Dark Reading".
Zscaler says attacks involving the use of SSL/TLS encryption jumped 260% in the first nine months of 2020 compared to the same period last year.📖 Read
via "Dark Reading".
Dark Reading
Malware Hidden in Encrypted Traffic Surges Amid Pandemic
Zscaler says attacks involving the use of SSL/TLS encryption jumped 260% in the first nine months of 2020 compared to the same period last year.
🕴 Flaws in Privileged Management Apps Expose Machines to Attack 🕴
📖 Read
via "Dark Reading".
The Intel Support Assistant is the latest Windows utility to be found that could expose millions of computers to privilege-escalation attacks through file manipulation and symbolic links.📖 Read
via "Dark Reading".
Dark Reading
Flaws in Privileged Management Apps Expose Machines to Attack
The Intel Support Assistant is the latest Windows utility to be found that could expose millions of computers to privilege-escalation attacks through file manipulation and symbolic links.
‼ CVE-2020-16126 ‼
📖 Read
via "National Vulnerability Database".
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16127 ‼
📖 Read
via "National Vulnerability Database".
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17053 ‼
📖 Read
via "National Vulnerability Database".
, aka 'Internet Explorer Memory Corruption Vulnerability'.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17019 ‼
📖 Read
via "National Vulnerability Database".
, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17064, CVE-2020-17065, CVE-2020-17066.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17055 ‼
📖 Read
via "National Vulnerability Database".
, aka 'Windows Remote Access Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17071 ‼
📖 Read
via "National Vulnerability Database".
, aka 'Windows Delivery Optimization Information Disclosure Vulnerability'.📖 Read
via "National Vulnerability Database".