‼ CVE-2020-35693 ‼
📖 Read
via "National Vulnerability Database".
On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26282 ‼
📖 Read
via "National Vulnerability Database".
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35702 ‼
📖 Read
via "National Vulnerability Database".
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document.📖 Read
via "National Vulnerability Database".
🦿 Why cybersecurity tools fail when it comes to ambiguity 🦿
📖 Read
via "Tech Republic".
Artificial intelligence will likely help with cybersecurity, though figuring out how to handle ambiguous situations is critical.📖 Read
via "Tech Republic".
TechRepublic
Why cybersecurity tools fail when it comes to ambiguity
Artificial intelligence will likely help with cybersecurity, though figuring out how to handle ambiguous situations is critical.
‼ CVE-2020-35707 ‼
📖 Read
via "National Vulnerability Database".
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35708 ‼
📖 Read
via "National Vulnerability Database".
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35705 ‼
📖 Read
via "National Vulnerability Database".
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35706 ‼
📖 Read
via "National Vulnerability Database".
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35704 ‼
📖 Read
via "National Vulnerability Database".
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35709 ‼
📖 Read
via "National Vulnerability Database".
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35710 ‼
📖 Read
via "National Vulnerability Database".
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35712 ‼
📖 Read
via "National Vulnerability Database".
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35711 ‼
📖 Read
via "National Vulnerability Database".
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35716 ‼
📖 Read
via "National Vulnerability Database".
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26766 ‼
📖 Read
via "National Vulnerability Database".
A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin Panel 2.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20412 ‼
📖 Read
via "National Vulnerability Database".
lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35347 ‼
📖 Read
via "National Vulnerability Database".
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35349 ‼
📖 Read
via "National Vulnerability Database".
Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35714 ‼
📖 Read
via "National Vulnerability Database".
Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35388 ‼
📖 Read
via "National Vulnerability Database".
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35713 ‼
📖 Read
via "National Vulnerability Database".
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.📖 Read
via "National Vulnerability Database".