‼ CVE-2020-26212 ‼
📖 Read
via "National Vulnerability Database".
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. Steps to reproduce the behavior: 1. Create a new planning with 'eduardo.mozart' user (from 'IT' group that belongs to 'Super-admin') into it's personal planning at 'Assistance' > 'Planning'. 2. Copy the CalDAV url and use a CalDAV client (e.g. Thunderbird) to sync the planning with the provided URL. 3. Inform the username and password from any valid user (e.g. 'camila' from 'Proativa' group). 4. 'Camila' has read-only access to 'eduardo.mozart' personal planning. The same behavior happens to any group. E.g. 'Camila' has access to 'IT' group planning, even if she doesn't belong to this group and has a 'Self-service' profile permission). This issue is fixed in version 9.5.3. As a workaround, one can remove the `caldav.php` file to block access to CalDAV server.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26243 ‼
📖 Read
via "National Vulnerability Database".
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27253 ‼
📖 Read
via "National Vulnerability Database".
A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to specifically craft a malicious packet resulting in a denial-of-service condition on the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27251 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious port ranges, which could result in remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25652 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25653 ‼
📖 Read
via "National Vulnerability Database".
A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25651 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29128 ‼
📖 Read
via "National Vulnerability Database".
petl before 1.68, in some configurations, allows resolution of entities in an XML document.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27255 ‼
📖 Read
via "National Vulnerability Database".
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious set attribute requests, which could result in the leaking of sensitive information. This information disclosure could lead to the bypass of address space layout randomization (ASLR).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7778 ‼
📖 Read
via "National Vulnerability Database".
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7779 ‼
📖 Read
via "National Vulnerability Database".
All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.📖 Read
via "National Vulnerability Database".
❌ Federated Learning: A Therapeutic for what Ails Digital Health ❌
📖 Read
via "Threat Post".
Researchers show the promise of Federated Learning to protect patient privacy and improve healthcare outcomes across the world.📖 Read
via "Threat Post".
Threat Post
Federated Learning: A Therapeutic for what Ails Digital Health
Researchers show the promise of Federated Learning to protect patient privacy and improve healthcare outcomes across the world.
❌ Changing Employee Security Behavior Takes More Than Simple Awareness ❌
📖 Read
via "Threat Post".
Designing a behavioral change program requires an audit of existing security practices and where the sticking points are.📖 Read
via "Threat Post".
Threat Post
Changing Employee Security Behavior Takes More Than Simple Awareness
Designing a behavioral change program requires an audit of existing security practices and where the sticking points are.
⚠ Bzzzzzzt! How safe is that keenly priced digital doorbell? ⚠
📖 Read
via "Naked Security".
How on earth are you supposed to figure out whether that home gadget you just ordered is full of security holes or not?📖 Read
via "Naked Security".
Naked Security
Bzzzzzzt! How safe is that keenly priced digital doorbell?
How on earth are you supposed to figure out whether that home gadget you just ordered is full of security holes or not?
‼ CVE-2020-27662 ‼
📖 Read
via "National Vulnerability Database".
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29043 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27663 ‼
📖 Read
via "National Vulnerability Database".
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29065 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13886 ‼
📖 Read
via "National Vulnerability Database".
Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27207 ‼
📖 Read
via "National Vulnerability Database".
Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29042 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.📖 Read
via "National Vulnerability Database".