‼ CVE-2020-7563 ‼
📖 Read
via "National Vulnerability Database".
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28361 ‼
📖 Read
via "National Vulnerability Database".
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module.📖 Read
via "National Vulnerability Database".
❌ Google Chrome 87 Closes High-Severity ‘NAT Slipstreaming’ Hole ❌
📖 Read
via "Threat Post".
Overall Google's Chrome 87 release fixed 33 security vulnerabilities.📖 Read
via "Threat Post".
Threat Post
Google Chrome 87 Closes High-Severity ‘NAT Slipstreaming’ Hole
Overall Google's Chrome 87 release fixed 33 security vulnerabilities.
🕴 As Businesses Move to Multicloud Approach, Ransomware Follows 🕴
📖 Read
via "Dark Reading".
The average US company uses 16 cloud services, but only a third of IT professional believe their security measures have kept up with the change.📖 Read
via "Dark Reading".
Dark Reading
As Businesses Move to Multicloud Approach, Ransomware Follows
The average US company uses 16 cloud services, but only a third of IT professional believe their security measures have kept up with the change.
🕴 Trump Fires CISA Director Chris Krebs 🕴
📖 Read
via "Dark Reading".
Christopher Krebs was fired via tweet shortly after the Cybersecurity and Infrastructure Security Agency called the 2020 election "the most secure in American history."📖 Read
via "Dark Reading".
Dark Reading
Trump Fires CISA Director Chris Krebs
Christopher Krebs was fired via tweet shortly after the Cybersecurity and Infrastructure Security Agency called the 2020 election the most secure in American history.
🦿 Linux and open source: The biggest issue in 2020 🦿
📖 Read
via "Tech Republic".
This year was rough for all involved--even Linux and open source didn't come through unscathed. See what Jack Wallen considers to be the biggest issue for Linux in 2020.📖 Read
via "Tech Republic".
TechRepublic
Linux and open source: The biggest issue in 2020
This year was rough for all involved--even Linux and open source didn't come through unscathed. See what Jack Wallen considers to be the biggest issue for Linux in 2020.
❌ Cisco Webex ‘Ghost’ Flaw Opens Meetings to Snooping ❌
📖 Read
via "Threat Post".
Cisco patched the Webex flaw, as well as three critical-severity vulnerabilities, in a slew of security updates on Wednesday.📖 Read
via "Threat Post".
Threat Post
Cisco Webex ‘Ghost’ Flaw Opens Meetings to Snooping
Cisco patched the Webex flaw, as well as three critical-severity vulnerabilities, in a slew of security updates on Wednesday.
🕴 Out With the Old Perimeter, in With the New Perimeters 🕴
📖 Read
via "Dark Reading".
A confluence of trends and events has exploded the whole idea of "the perimeter." Now there are many perimeters, and businesses must adjust accordingly.📖 Read
via "Dark Reading".
Dark Reading
Out With the Old Perimeter, in With the New Perimeters
A confluence of trends and events has exploded the whole idea of the perimeter. Now there are many perimeters, and businesses must adjust accordingly.
‼ CVE-2020-26079 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by logging in as an administrative user and crafting a call for user information. A successful exploit could allow the attacker to obtain hashes of user passwords on an affected device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28362 ‼
📖 Read
via "National Vulnerability Database".
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26076 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive information. An attacker could exploit this vulnerability by sending crafted curl commands to an affected device. A successful exploit could allow the attacker to view sensitive database information on the affected device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26097 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26075 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28366 ‼
📖 Read
via "National Vulnerability Database".
Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26068 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26080 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the user management functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could exploit this vulnerability by manipulating JSON payloads to target different domains on an affected system. A successful exploit could allow the attacker to manage user information for users in different domains on an affected system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26078 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit this vulnerability by crafting API requests and sending them to an affected system. A successful exploit could allow the attacker to overwrite files on an affected system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3392 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this vulnerability by sending API requests to an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system, including information about the devices that the system manages, without authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4592 ‼
📖 Read
via "National Vulnerability Database".
IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to an error when using segmented messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26081 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users on an affected system. The vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web UI. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information on an affected system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26554 ‼
📖 Read
via "National Vulnerability Database".
REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.📖 Read
via "National Vulnerability Database".