🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-8908 ‼

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

📖 Read

via "National Vulnerability Database".
16 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-29311 ‼

Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software.

📖 Read

via "National Vulnerability Database".
16 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-16196 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

📖 Read

via "National Vulnerability Database".
17 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26268 ‼

In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

📖 Read

via "National Vulnerability Database".
15 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-4829 ‼

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Force ID: 189960.

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-19142 ‼

iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php.

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-13526 ‼

The ‘sort’ parameter in the download page clientSetupAjax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2016-15001 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-16608 ‼

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-35076 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.

📖 Read

via "National Vulnerability Database".
14 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-19527 ‼

iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php.

📖 Read

via "National Vulnerability Database".
13 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26269 ‼

In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.

📖 Read

via "National Vulnerability Database".
13 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26270 ‼

In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

📖 Read

via "National Vulnerability Database".
15 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2019-4738 ‼

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from the dashboard UI which could be used in further attacks against the system. IBM X-Force ID: 172753.

📖 Read

via "National Vulnerability Database".
17 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26201 ‼

Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH.

📖 Read

via "National Vulnerability Database".
18 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-25967 ‼

The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SST) vulnerability

📖 Read

via "National Vulnerability Database".
19 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-35090 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.

📖 Read

via "National Vulnerability Database".
18 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26267 ‼

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

📖 Read

via "National Vulnerability Database".
19 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-35110 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.

📖 Read

via "National Vulnerability Database".
17 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-26266 ‼

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

📖 Read

via "National Vulnerability Database".
15 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-8908 ‼

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

📖 Read

via "National Vulnerability Database".
13 views