‼ CVE-2020-35943 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28394 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12283)📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28392 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in SIMARIS configuration (All versions). During installation to default target folder, incorrect permissions are configured for the application folder and subfolders which could allow an attacker to gain persistence or potentially escalate privileges should a user with elevated credentials log onto the machine.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35942 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35572 ‼
📖 Read
via "National Vulnerability Database".
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25141 ‼
📖 Read
via "National Vulnerability Database".
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
❌ Attackers Exploit Critical Adobe Flaw to Target Windows Users ❌
📖 Read
via "Threat Post".
A critical vulnerability in Adobe Reader has been exploited in "limited attacks."📖 Read
via "Threat Post".
Threat Post
Attackers Exploit Critical Adobe Flaw to Target Windows Users
A critical vulnerability in Adobe Reader has been exploited in "limited attacks."
🦿 Plex patches media server bug potentially exploited by DDoS attackers 🦿
📖 Read
via "Tech Republic".
All users of Plex Media Server are urged to apply the hotfix, which directs their servers to respond to UDP requests only from the local network and not the public internet.📖 Read
via "Tech Republic".
TechRepublic
Plex patches media server bug potentially exploited by DDoS attackers
All users of Plex Media Server are urged to apply the hotfix, which directs their servers to respond to UDP requests only from the local network and not the public internet.
🔏 Florida Water Hack Underscores Lack of Municipal Cyber Funding 🔏
📖 Read
via "Digital Guardian".
The hack is another example of how damaging cyber attacks against small cities and infrastructure can be.📖 Read
via "Digital Guardian".
Digital Guardian
Florida Water Hack Underscores Lack of Municipal Cyber Funding
The hack is another example of how damaging cyber attacks against small cities and infrastructure can be.
❌ Actively Exploited Windows Kernel EoP Bug Allows Takeover ❌
📖 Read
via "Threat Post".
Microsoft addressed 56 security vulnerabilities for February Patch Tuesday -- including 11 critical and six publicly known. And, it continued to address the Zerologon bug.📖 Read
via "Threat Post".
Threat Post
Actively Exploited Windows Kernel EoP Bug Allows Takeover
Microsoft addressed 56 security vulnerabilities for February Patch Tuesday — including 11 critical and six publicly known. And, it continued to address the Zerologon bug.
❌ Google Play Boots Barcode Scanner App After Ad Explosion ❌
📖 Read
via "Threat Post".
A barcode scanner with 10 million downloads is removed from Google Play marketplace after ad blitz hits phones.📖 Read
via "Threat Post".
Threat Post
Google Play Boots Barcode Scanner App After Ad Explosion
A barcode scanner with 10 million downloads is removed from Google Play marketplace after ad blitz hits phones.
‼ CVE-2021-21478 ‼
📖 Read
via "National Vulnerability Database".
SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21472 ‼
📖 Read
via "National Vulnerability Database".
SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this allows an authenticated attacker to perform various security attacks like Directory Traversal, Password Brute force Attack, SMB Relay attack, Security Downgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21477 ‼
📖 Read
via "National Vulnerability Database".
SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26191 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level of RBAC privileges thus being able to read arbitrary data, tamper with system software or deny service to users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14343 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21502 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH RBAC privilege that has an expired account may potentially exploit this vulnerability, giving them access to the same things they had before account expiration. This may by a high privileged account and hence Dell recommends customers upgrade at the earliest opportunity.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26193 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISI_PRIV_CLUSTER privilege may exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21475 ‼
📖 Read
via "National Vulnerability Database".
Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26195 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issue to slow down the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21444 ‼
📖 Read
via "National Vulnerability Database".
SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.📖 Read
via "National Vulnerability Database".