🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-4004 ‼

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

📖 Read

via "National Vulnerability Database".
36 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-28845 ‼

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.

📖 Read

via "National Vulnerability Database".
35 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-20739 ‼

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.

📖 Read

via "National Vulnerability Database".
29 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-19878 ‼

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to historical data from AprolSqlServer by bypassing authentication, a different vulnerability than CVE-2019-16358.

📖 Read

via "National Vulnerability Database".
26 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-28921 ‼

An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-19873 ‼

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.

📖 Read

via "National Vulnerability Database".
24 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-19874 ‼

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364.

📖 Read

via "National Vulnerability Database".
24 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-27746 ‼

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.

📖 Read

via "National Vulnerability Database".
23 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15685 ‼

Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-27745 ‼

Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15684 ‼

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-7780 ‼

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

📖 Read

via "National Vulnerability Database".
24 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15680 ‼

In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.

📖 Read

via "National Vulnerability Database".
23 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15686 ‼

Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-19877 ‼

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer, a different vulnerability than CVE-2019-16357.

📖 Read

via "National Vulnerability Database".
25 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-19875 ‼

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.

📖 Read

via "National Vulnerability Database".
27 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15681 ‼

In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.

📖 Read

via "National Vulnerability Database".
28 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-28922 ‼

An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write arbitrary physical memory. This could lead to arbitrary Ring-0 code execution and escalation of privileges.

📖 Read

via "National Vulnerability Database".
28 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-25014 ‼

A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.

📖 Read

via "National Vulnerability Database".
27 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15682 ‼

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.

📖 Read

via "National Vulnerability Database".
27 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-15683 ‼

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

📖 Read

via "National Vulnerability Database".
29 views